Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Tweet Share Card
v0.1.0Convert an X/Twitter post URL into a polished share card image by capturing the tweet content and compositing it on a styled background.
⭐ 0· 61·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The description says it converts a tweet URL into a share image, which matches the included scripts' purpose. However the skill metadata declared no required binaries/OS, while the capture script clearly depends on macOS-specific tools (osascript and /usr/sbin/screencapture) and a visible Google Chrome process. The package should have declared an OS restriction and required binaries.
Instruction Scope
Runtime instructions require opening the tweet in the user's logged-in Chrome profile and taking a visible-screen screenshot of the browser window. That is within the stated goal (a real screenshot) but grants the skill the ability to operate the user's browser and capture portions of the screen — which could expose unrelated on-screen content. The SKILL.md also prefers a 'dedicated Chrome profile' but gives no guidance on how that profile is selected or how profile isolation is enforced.
Install Mechanism
No install spec (instruction-only) which reduces distribution risk. However two local Python scripts are included and intended to be executed. There is no network download or external installer, but executing bundled scripts still requires runtime permissions and appropriate binaries (Python, PIL).
Credentials
The skill requests no environment variables or credentials, which is good, but it implicitly requires access to the user's desktop environment and Chrome session (which are not declared). It also assumes presence of system utilities and a logged-in X/Twitter session. The absence of these requirements in metadata is a proportionality/mis-declaration issue.
Persistence & Privilege
The skill is not marked always:true and does not modify other skills or system-wide settings. It writes output files to workspace/tmp only, which is normal for an image-generation task.
What to consider before installing
This skill will open a browser tab in a visible Chrome window and take a screenshot of the browser area using macOS-specific tools (osascript and /usr/sbin/screencapture). That means: (1) it only realistically works on macOS with Google Chrome available; (2) it can capture on-screen content — potentially sensitive information if the browser or window shows other data; (3) the skill metadata does not declare these OS/binary requirements, which is an inconsistency you should ask the author to fix. Before installing: verify you want a skill that can control your browser and capture screenshots, confirm you are on macOS and have a dedicated Chrome profile for this use, inspect the two included scripts, and ensure the agent is only allowed to run the skill when you explicitly invoke it (disable autonomous invocation if you prefer). If you are not on macOS or do not want desktop/browser screenshots to be taken, do not install.Like a lobster shell, security has layers — review code before you run it.
latestvk9799wcbssa54z7mdcfg58yprs83cb9z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.