xfetch

Use xfetch CLI to fetch X/Twitter data - tweets, user profiles, search results, timelines, lists, DMs, and notifications. Use this skill whenever you need to...

This SKILL.md is coherent with a cookie-based X/Twitter scraper, but it requires reading browser cookies/profiles (sensitive) and implies using an npm package (@lxgic/xfetch) from an unknown source. Before installing or using it: 1) Confirm where the 'xfetch' binary would come from and review the npm package source and maintainer; 2) Consider the privacy risk of allowing access to your browser profile/cookies and DMs — don't run it on machines with sensitive accounts; 3) Prefer using official APIs with scoped credentials where possible; 4) If you must run it, do so in an isolated environment (VM/container) and inspect where it stores auth tokens and any downloaded code; 5) Be aware this may violate X/Twitter terms of service and could expose private messages and tokens if misused.

Type: OpenClaw Skill Name: xfetch Version: 1.0.0 The xfetch skill provides an AI agent with the capability to extract sensitive browser cookies (via `xfetch auth extract`) and access private user data including Direct Messages and notifications. While these features are aligned with the stated purpose of a Twitter scraper, the ability to programmatically retrieve browser credentials and private communications poses a high risk for data exfiltration and credential theft if the agent is manipulated. No explicit malicious exfiltration endpoints or obfuscated commands were found in the SKILL.md or _meta.json files.