xclaw

Extract posts from X (Twitter) timeline or profile pages with engagement metrics, media URLs, and download local copies. Use when asked to scrape, list, or a...

This skill appears to do what it says: it will navigate X pages, scrape DOM content, and save an intel markdown file plus media into ../../intel/x/media/{timestamp}. Before installing or running it, consider: (1) If your agent's browser is logged into your X account, the skill may scrape private/home-timeline content — log out or use an unauthenticated session if you don't want that. (2) The skill will write files two levels up from the execution directory—verify that path is acceptable and won't overwrite important files. (3) Scraping may violate X/Twitter terms of service or copyright; review legal/ethical implications. (4) If you need the skill to access protected data (e.g., private messages or an authenticated feed), expect to provide authentication separately; the skill does not declare credentials. If these points are acceptable, the skill is internally coherent.

Type: OpenClaw Skill Name: x-openclaw Version: 1.0.0 The x-openclaw skill (SKILL.md) is designed to scrape X (Twitter) posts and download associated media. It instructs the agent to execute shell commands (mkdir and curl) to create directories and download files based on data extracted from the web (URLs and post IDs). While the intent is aligned with the stated purpose, the use of shell commands with externally sourced, unsanitized data presents a potential shell injection vulnerability, and the broad file/network access via the shell meets the criteria for a suspicious classification.