X/Twitter Agent

Post tweets, read mentions, reply, like, retweet, and search on X/Twitter using the official v2 API. Use for all X interactions instead of bird-cli or browse...

Do not install or run this skill until you validate a few things: (1) confirm the package actually includes the xpost script or obtain its canonical source and review its code before making it executable — never run an uninspected script placed in your ~/clawd/bin; (2) ask the publisher to update the registry metadata to declare the required credentials (X_API_KEY, X_API_SECRET, X_ACCESS_TOKEN, X_ACCESS_TOKEN_SECRET, X_USER_ID) so you know what secrets the skill needs; (3) inspect xpost for network calls/exfiltration beyond api.twitter.com and for unsafe shell execs; (4) store API keys securely (restrict file permissions: chmod 600) or use a secrets manager rather than a world-readable file; (5) prefer a skill with a verifiable source/homepage and explicit install spec; (6) if you must test, run the CLI in an isolated environment (sandbox/container) and review logs. These inconsistencies do not prove malice, but they are enough reason to proceed cautiously.

Type: OpenClaw Skill Name: x-twitter-agent Version: 1.0.0 The skill enables automated X (Twitter) interactions via a CLI tool (xpost) and cron jobs, requiring high-risk capabilities including shell execution, network access, and file system access to sensitive API keys in ~/.config/x-api/keys.env. Although the SKILL.md documentation provides extensive safety guidelines and prompt injection defenses, the broad permissions and automated system-level interactions are classified as suspicious according to the provided criteria for risky capabilities.