Yarn - Control and Access Threads.com via the CLI

Interact with Threads (by Meta) via the yarn-threads-cli. Use when the user wants to read their home feed, likes, saved posts, or a specific thread; look up...

This skill appears to be what it says: a CLI client for Threads that needs Threads authentication. Before installing or using it: 1) Verify the npm package and linked GitHub repo (maintainer, recent commits, open issues) because 'npm install -g' runs third-party code on your machine. 2) Avoid pasting full session cookies or tokens into third-party services—prefer pointing the CLI at a local browser profile only if you trust the tool and run it locally. 3) If you must use manual tokens, consider using a disposable/limited account and be prepared to rotate/revoke cookies if compromised. 4) Note the minor metadata inconsistency: the skill metadata doesn't list 'npm' or the CLI as required binaries even though the docs instruct installing them—this is likely an oversight but worth confirming with the publisher. If you want higher assurance, inspect the yarn-threads-cli source on the linked GitHub repo before installing.

Type: OpenClaw Skill Name: yarn-threads-cli Version: 0.1.3 The skill is classified as suspicious due to its reliance on the `yarn-threads-cli` tool, which is explicitly stated in `SKILL.md` and `references/commands.md` to authenticate by accessing sensitive browser profile data (Chrome/Firefox cookies). While this capability is necessary for the tool's stated purpose of interacting with Threads, it grants the underlying CLI tool significant access to potentially sensitive user information. This represents a high-risk capability, as a compromised `yarn-threads-cli` or its dependencies could lead to credential theft, even though the skill bundle itself does not contain explicit malicious instructions for the agent to perform such actions.