ZeeLin Twitter / X 自运营 Skill

Automate Twitter/X growth tasks including scraping trending topics, generating tweets, posting tweets via browser automation, commenting on follow-back posts...

What to consider before installing: - The skill itself does not include code to authenticate/post to X; it calls an external script at /Users/youke/.openclaw/workspace/skills/zeelin-twitter-web-autopost/scripts/tweet.sh. Inspect that script (and any referenced skills: zeelin-twitter-web-autopost, x-auto-growth, zeelin-x-creator-briefing) to see how credentials are stored/used. If tweet.sh is replaced, this skill could cause unwanted posts. - SKILL.md claims direct CDP publishing (port 9222) but none of the included files implement CDP — ask the publisher which component implements CDP and review it before allowing automation. - Hardcoded absolute paths (/Users/youke/...) indicate developer-specific artifacts and may break or be abused; consider editing scripts to use workspace-relative paths or review/replace them with safe equivalents. - The scripts fetch external data (Hacker News API, a THU report site) and open many X pages; review the network endpoints to ensure they are expected and safe. Limit session/commenting frequency to avoid platform spam detection. - Because the skill will call other local scripts to perform posting, verify that any posting helper handles credentials securely (no plaintext tokens in scripts), and run in a sandbox or with a throwaway account until you confirm behavior. - If you need higher assurance, request the missing components (the referenced tweet.sh and any CDP implementation) and permissioned details about where credentials are stored; without those, the skill's behavior is ambiguous.

Type: OpenClaw Skill Name: zeelin-twitter-x-auto-ops Version: 1.2.0 The skill automates Twitter/X operations using high-risk capabilities including shell script execution, network requests (Hacker News API and a specific GitHub Pages site), and direct Chrome DevTools Protocol (CDP) browser control. Multiple scripts (e.g., auto_ai_tweet.sh, post_latest_report_once.sh, and run_x_skill.sh) contain hardcoded absolute paths to a specific user's home directory (/Users/youke/), which is a significant configuration flaw and potential vulnerability. While the behavior aligns with the stated goal of social media management and trend discovery from https://thu-nmrc.github.io/THU-ZeeLin-Reports/, the combination of broad system access and fragile, environment-specific coding warrants a suspicious classification.