Omni-X
v1.0.0Extract X (Twitter) data including user profiles, posts, followers, followings, media, and search results. This skill provides comprehensive Twitter data ext...
⭐ 0· 61·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the implementation: the code uses the TweeterPy library to extract profiles, tweets, followers, followings, media, and search results. Methods, parameters, and documented auth levels align with the declared capabilities.
Instruction Scope
SKILL.md and LOGIN_GUIDE explicitly instruct obtaining and supplying an auth_token (a browser cookie) and provide username/password login and session save/load flows. Those instructions are coherent with the skill's goal but instruct the user/agent to handle highly sensitive data (session cookies and credentials). The guides do not request unrelated system files or unrelated credentials.
Install Mechanism
There is no automated install spec in the registry, but requirements.txt and setup.py declare the dependency 'tweeterpy' (pip). This is a standard PyPI‑style dependency (moderate risk). There are no opaque download URLs or archive extracts, but installing third‑party scraping libraries should be reviewed and vetted before use.
Credentials
The skill declares no required environment variables, which is consistent. However the runtime and docs encourage supplying an auth_token or plain credentials (username/password). Requesting those session tokens is proportionate to the stated functions but is sensitive—there's no guidance to store tokens securely or to limit token lifetime.
Persistence & Privilege
The skill does not request 'always: true' or system-wide changes. It supports saving/loading sessions (normal for this use case). The skill may be invoked autonomously by agents (default), which combined with supplied credentials could increase risk—note but not inherently a misfeature.
Assessment
This package appears to implement a Twitter/X scraper using TweeterPy and its behavior matches its documentation. Before installing or supplying credentials: 1) Do not paste your auth_token or username/password into an untrusted environment—treat the cookie like a password. 2) Prefer guest mode for basic lookups; only provide auth_token if you understand the risk and trust the code. 3) Inspect tweeterpy and Omni‑X source (especially session save/load) to see where tokens are stored/transmitted; run in an isolated environment or container. 4) Be aware scraping can violate X/Twitter terms and may lead to account action. 5) Pin and audit dependencies (tweeterpy) and prefer manual install so you can review packages. If you want, I can point out exact lines where auth_token is used and where sessions are saved/loaded, or summarize the code paths that handle credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk972572mzbh3km75danq59sq8d84801x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.