X Bookmarks Archiver
PassAudited by ClawScan on May 10, 2026.
Overview
The skill matches its stated bookmark-archiving purpose, but it uses your authenticated X bookmark data, may send bookmark details to OpenAI, and stores archives/state locally.
Install only if you are comfortable granting the bird CLI access to your X bookmarks. Verify the bird CLI source, leave OPENAI_API_KEY unset if you do not want bookmark details sent to OpenAI, and periodically review or delete the generated X-knowledge and state files if they contain sensitive bookmarks.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill can execute the local bird CLI and retrieve bookmarks from the X account authenticated in that tool.
The skill invokes a local shell command to run the bird CLI and fetch bookmarks. The command is fixed and purpose-aligned, but users should know it executes an authenticated local tool.
const output = execSync(`bird bookmarks -n ${FETCH_COUNT} --json`, { encoding: 'utf8', timeout: 30000 });Run it only after verifying the bird CLI installation and understanding which X account is authenticated.
The skill can read bookmark data from the authenticated X account, and optional OpenAI use may consume API quota.
The skill relies on delegated X access through bird and may use an OpenAI API key, even though registry metadata declares no primary credential. This is aligned with the stated purpose but is sensitive authority.
# Ensure bird CLI is installed and authenticated bird --version # Set OpenAI API key (optional, for AI summaries) export OPENAI_API_KEY="sk-..."
Use only accounts and API keys you intend to grant for this purpose, and revoke or unset them when not needed.
Bookmark URLs and associated tweet text may be processed by OpenAI if the API key is set.
When OPENAI_API_KEY is present, the skill sends the bookmarked URL and tweet text to OpenAI to generate metadata. This provider call is disclosed and purpose-aligned, but it moves bookmark content outside the local machine.
URL: ${url}
Tweet: ${originalText || 'N/A'} ... fetch('https://api.openai.com/v1/chat/completions', {Leave OPENAI_API_KEY unset for local-only fallback summaries, or review OpenAI's data handling terms before enabling AI summaries.
Generated archive files may contain untrusted web or tweet-derived content and may remain available to future workspace searches or agent tasks.
The skill persists bookmark-derived and AI-generated content as markdown in the OpenClaw workspace. This is the intended archive behavior, but the content originates from external/social sources and may later be reused as agent context.
const frontmatter = `--- ... link: ${bookmark.url} ... ${metadata.summary}\n`; ... fs.writeFileSync(finalFilename, frontmatter);Review generated markdown before treating it as trusted knowledge, and delete or exclude sensitive archives when appropriate.
Installing the wrong or compromised external CLI could expose the X account data that bird can access.
The skill depends on an external third-party CLI that is not bundled or pinned in the artifacts. The dependency is central to the purpose, but users must trust it before authenticating it to X.
**bird CLI** - Install from [steipete/bird](https://github.com/steipete/bird)
Verify the bird repository and release before installation, and prefer pinned or checksummed releases where possible.