browser-read-x

Extract the main X/Twitter post or article content from a page that is already open in the browser (using browser act evaluate).

Security Scan

The skill's code and runtime instructions match its stated purpose (extracting the main X/Twitter post/article from an already-open browser page); it requires no credentials, makes no network installs, and the included JS appears to operate only on the page DOM.

Purpose & Capability

Name/description match the code and instructions: the skill only includes a DOM-extraction script (extract.js) and SKILL.md describing how to run it via browser act evaluate. No unrelated credentials, binaries, or installs are requested.

Instruction Scope

SKILL.md instructs the agent to run the bundled JS via browser act evaluate against a page already open in the browser. The instructions reference only the included extract.js and standard browser actions; they do not ask the agent to read unrelated files, environment variables, or send data to external endpoints.

Install Mechanism

No install spec is present (instruction-only with one included script). Nothing is downloaded or written to disk by an installer, and the file contents are provided directly in the skill bundle.

Credentials

The skill declares no required environment variables, credentials, or config paths. The script operates on DOM content only and does not reference process env or secret tokens.

Persistence & Privilege

Skill is not always:true and does not request elevated platform privileges or modify other skills or system config. It can be invoked autonomously (platform default), which is expected for a user-invocable skill.

Assessment

This skill runs the supplied JavaScript inside the web page's DOM context to extract the main post/article. That is consistent with its purpose, but remember: any JS you run in page context can read whatever is currently loaded in that page (including private content visible to the browser). The included extract.js appears to only traverse and prune DOM nodes and produce markdown-like text — it does not perform network calls or access environment variables — but you should: (1) review the full extract.js source before installing/running, (2) avoid invoking it on pages that contain sensitive private data you don't want read, and (3) prefer skills from known authors if you require stronger trust guarantees. If you want higher assurance, run the code in a controlled/test page first or request the full untruncated extract.js for manual review.

Site-specific extractor for X/Twitter. It is tuned to return the central post/article content while filtering UI chrome such as sidebars, trends, login/signup prompts, reaction metrics, and article footer/promotional blocks.

Use case

• web_fetch is noisy or blocked (auth-required/public X/X-protected pages).
• You need tweet/article text from an already-open X page in browser.
• You specifically want the main status/article body, not sidebar or CTAs.

How to use

1. Navigate to the URL with browser navigate (or ensure the page is already open).
2. Run browser act with kind="evaluate" and pass the contents of skills/browser-read-x/extract.js as fn.
3. The script returns:
   • title
   • content (plain markdown-ish text with reduced X UI noise)
   • excerpt
   • byline
   • siteName
   • length
   • url

Example

{
  "action": "act",
  "kind": "evaluate",
  "targetId": "...",
  "fn": "(() => { ... })()"
}

Notes

• Self-contained and safe to pass directly as JS to browser act.
• The script prefers the specific status/article node on X and falls back to generic article/main selection if that fails.
• For non-X pages it still behaves similarly to the generic extractor (best-effort cleanup + markdownish text conversion).