Iran Intelligence Radar (Persian X Monitor)
v1.0.0Monitor Persian-language X (Twitter) activity related to Iran, detect high-signal geopolitical events, translate posts, score escalation risk, and generate a...
⭐ 0· 229·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, and code match: the package implements Persian X/Twitter search, translation, trending detection, escalation scoring, Telegram alerts, and billing. Minor inconsistency: SKILL.md/tools list includes 'skillpay_billing' and 'telegram_api' as external tools, but the code implements billing internally (billing.py) and calls telegram via telegram_alert.py (it does not accept a 'telegram_api' tool function). The agent expects host-provided search/translate tool functions (ToolRegistry) — which is coherent but should be noted: without those tools the skill falls back to deterministic mock data.
Instruction Scope
SKILL.md and prompts/system_prompt.md describe scanning, translating, scoring, and alerting — and the code follows that flow. The runtime will perform outbound HTTP calls (SkillPay billing and Telegram API) and write logs/state files to disk. The pre-scan detected a 'system-prompt-override' pattern (the skill ships a system_prompt.md to drive behavior), which is expected for an agent but is something to review because system prompts can alter agent behavior.
Install Mechanism
No install spec; code is instruction + Python files with a minimal requirements.txt (pyyaml, requests, python-dateutil). No network-download/install step in the manifest. Risk from install is low, but running the code will write files and make network calls.
Credentials
The registry metadata declares no required environment variables, but the shipped config.yaml expects sensitive values (telegram.bot_token, telegram.chat_id) to be placed in the skill config file. Billing code also honors SKILLPAY_BASE_URL via environment. The mismatch (no declared secrets vs. actual config requiring secrets) is concerning: it encourages putting credentials in a repo file instead of a secured platform secret, and the skill will transmit user_id and billing requests to external endpoints.
Persistence & Privilege
always:false (good). The skill creates/writes logs and state files (logs/, charge_cache.json, trending_history.json, daily_history.json) under the project root and skill directories. This is expected for local persistence, but it means the skill will store histories and potentially sensitive outputs on disk — check where these files will live in your environment.
Scan Findings in Context
[system-prompt-override] expected: The package includes prompts/system_prompt.md which defines the agent/system behavior. Shipping an internal system prompt is expected for an agent-style skill, but system-prompt patterns are high-risk if unreviewed because they can change runtime behavior or be used to manipulate the host agent.
What to consider before installing
Key things to check before installing or running:
- Credentials: The skill expects Telegram bot_token/chat_id in skills/persian_x_radar/config.yaml (placeholders are present). Do NOT store real credentials in a checked-in config file; prefer the platform's secret store. The skill will call api.telegram.org and a SkillPay endpoint.
- External network calls: billing.py contacts https://skillpay.me/api/v1 by default (overridable via SKILLPAY_BASE_URL) and telegram_alert.py posts to the Telegram API. If you run this in your environment, those external services will receive data (e.g., user_id and billing requests). Review privacy implications.
- Tools integration: The code expects the host to supply search/translate functions (ToolRegistry). If you do not provide real X search/translate tools, the skill will use deterministic mock data. Confirm how you'll supply these connectors and their credentials (Twitter/X API or other crawlers).
- Files written to disk: The skill writes logs and JSON history files under the project root/logs and skill folders. Ensure the runtime directory is appropriate and that logs/history will not leak sensitive data.
- Prompt content: The skill ships a system prompt file which affects agent behavior. Review prompts/system_prompt.md to ensure it does not contain instructions you do not want the agent to follow.
- Operational & legal caution: This skill monitors politically sensitive content related to Iran. Ensure you have legal/ethical authority to collect/process this data and consider operational security for running monitoring tools.
If you decide to proceed: run the skill in an isolated/sandboxed environment, remove or replace placeholder tokens in config.yaml with platform-managed secrets, and provide vetted connector implementations for X search and translation rather than embedding credentials in repository files.Like a lobster shell, security has layers — review code before you run it.
geopoliticsvk97cqq2krqcs9dz84egw0ddjk582ab2qintelligencevk97cqq2krqcs9dz84egw0ddjk582ab2qiranvk97cqq2krqcs9dz84egw0ddjk582ab2qlatestvk97cqq2krqcs9dz84egw0ddjk582ab2qmonitoringvk97cqq2krqcs9dz84egw0ddjk582ab2qnewsvk97cqq2krqcs9dz84egw0ddjk582ab2qosintvk97cqq2krqcs9dz84egw0ddjk582ab2qtwittervk97cqq2krqcs9dz84egw0ddjk582ab2q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.