X Extract

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill mostly matches its stated tweet-extraction purpose, but it may reuse a logged-in browser profile despite claiming it works without credentials.

Install only if you are comfortable with browser-based scraping of public X/Twitter pages. Prefer a fresh non-logged-in browser profile, avoid using it on private or protected tweets, and approve any media downloads only after checking the source URL and destination path.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the selected browser profile is logged in, the agent could retrieve or display content that is visible only because of the user's account session, not just public tweet data.

Why it was flagged

The skill uses a browser profile, which may contain a logged-in X session, while presenting the workflow as credential-free and unable to access login-required content. The artifacts do not bound the profile to a clean unauthenticated session.

Skill content
browser action=open profile=openclaw targetUrl=<x.com-url> ... **No credentials**: Cannot access protected tweets, DMs, or login-required content
Recommendation

Use a fresh, non-logged-in browser profile for this skill, and require explicit user confirmation before extracting anything that appears protected, private, age-restricted, or account-specific.

What this means

The agent may save remote media files onto the user's machine when asked to download images.

Why it was flagged

The media-download feature intentionally invokes local command-line download tools using URLs found in the page. This is purpose-aligned and user-requested, but it is still local command execution and remote file download.

Skill content
If user requests `--download-media` or "download images" ... Use `exec` with `curl` or `wget` to download: `curl -L -o "tweet-{tweetId}-image-{n}.jpg" "<media-url>"`
Recommendation

Only download media after user approval, restrict downloads to expected X/Twitter media hosts where possible, and report exact saved paths.