Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
X/Twitter Research
v1.0.0Research trending topics, tweets, user profiles, and conversations on X (Twitter) using twitterapi.io for insights and trend reports.
⭐ 0· 310·2 current·2 all-time
by@0xartex
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and the included script legitimately call twitterapi.io endpoints for Twitter/X research, which matches the name/description. However, the skill metadata declares no required credentials or binaries while the instructions and script rely on an API key (TWITTERAPI_KEY) and common tools (curl, jq). Also the script uses a hard-coded absolute default output directory (/home/artex/.openclaw/...), which is inconsistent with a general-purpose research skill and suggests sloppy packaging.
Instruction Scope
Runtime instructions require sourcing ~/.openclaw/secrets/twitterapi.env (to obtain TWITTERAPI_KEY) and then only make requests to api.twitterapi.io — no unexpected external endpoints. That is appropriate for the stated purpose. The concerns: (1) instructions and script reference a specific secrets path and a hard-coded /home/artex output path (may cause writes to another user's directory or fail unexpectedly), and (2) the skill does not declare or validate the external tools it expects (curl, jq).
Install Mechanism
There is no install spec (instruction-only plus a shell script), which minimizes install-time risk. That said the shipped script expects curl, jq, mkdir, head, date and will write files to disk; the package does not declare these requirements. No downloads or archive extraction are present.
Credentials
The skill requires a TWITTERAPI_KEY (and instructs storing it at ~/.openclaw/secrets/twitterapi.env), but the registry metadata lists no required env vars or primary credential. This mismatch is a red flag: the skill will access a secret not declared to the platform. There are no other unrelated credential requests, so the sensitivity is limited to that single API key, but it should be declared explicitly.
Persistence & Privilege
The skill does not request permanent always:true, does not alter other skills or global agent settings, and only writes reports to disk. Autonomous invocation is allowed (platform default) but not combined with other high privileges, so no elevated persistence concerns are present.
What to consider before installing
Before installing or running this skill:
- Expect it to need a twitterapi.io API key (TWITTERAPI_KEY). The skill's metadata does not declare that; confirm and only provide a key you trust for this use. Store the key in a secure file and ensure it is not world-readable.
- The SKILL.md and script will source ~/.openclaw/secrets/twitterapi.env — check that file to ensure it contains only the expected TWITTERAPI_KEY and nothing else.
- The bundled script assumes curl and jq are available; verify those binaries exist on the agent host. Consider adding checks in the script or to the metadata.
- The script's default OUTPUT_DIR is hard-coded to /home/artex/.openclaw/workspace/research. Change it to a portable path (use $HOME/.openclaw/... or pass an explicit output directory) to avoid writing into someone else's home or failing unexpectedly.
- Review the script for any other hidden endpoints or modifications; run it in a sandbox or with a throwaway API key first to confirm behavior and costs.
- Note rate/cost guidance in the SKILL.md and monitor API usage to avoid unexpected charges.
Resolve the metadata mismatches (declare required env var(s) and required binaries) or treat this skill as untrusted until fixed.Like a lobster shell, security has layers — review code before you run it.
latestvk973j377zxfngzqpgn03ns4k9d82myar
License
MIT-0
Free to use, modify, and redistribute. No attribution required.