Security checks across malware telemetry and agentic risk
This skill does what it claims, but it gets persistent credentials and can automatically remove X/Twitter bookmarks without a fresh confirmation, so it needs careful review before use.
Install only if you are comfortable with the skill reading your X bookmarks, sending bookmark content/URLs to third-party services, posting results to Discord, and potentially removing bookmarks automatically. Use --dry-run first, prefer --no-unbookmark or read-only OAuth scopes unless deletion is intentional, store tokens in a real secret manager where possible, and review any cron/launchd/systemd setup before enabling unattended polling.
`Bookmark sweep: ${triaged} triaged, ${skipped} skipped`,
JSON.stringify({ triaged, skipped, total: bookmarks.length }),
'knowledge'
], { env: process.env });
} else {
console.log('[bookmark-poll] emit-event.sh not available — skipping bus event');
}SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# Load credentials from .env file if it exists (non-OpenClaw users)
ENV_FILE="${OPENCLAW_WORKSPACE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}/.env"
if [ -f "$ENV_FILE" ]; then
set -a
source "$ENV_FILE"2. Save the new token to `data/x-oauth2-new-refresh-token.txt` 3. Log a warning: `⚠️ Refresh token rotated — update X_OAUTH2_REFRESH_TOKEN in your env` **You must update `X_OAUTH2_REFRESH_TOKEN`** in your `.env` file or plist after each rotation, or the next run will fail with `invalid_grant`. The new token is always at `data/x-oauth2-new-refresh-token.txt`. ---
# → Opens browser, captures callback, saves to data/x-oauth2-token-cache.json ``` Store credentials in your gateway plist (or env): ``` X_OAUTH2_CLIENT_ID — app OAuth 2.0 client ID X_OAUTH2_CLIENT_SECRET — app OAuth 2.0 client secret
### 4. Register the launchd Poller (Optional — for automated polling) **Note:** `scripts/ai.watson.knowledge-intake-poll.plist` is a template. Customize it first: 1. Edit the file to replace `/PATH/TO/skills/x-bookmark-triage/scripts/poll-channel.js` with the actual path 2. Replace `YOUR_BOT_TOKEN`, `YOUR_ANTHROPIC_KEY`, `YOUR_CHANNEL_ID`, `/PATH/TO/workspace` with real values
```bash # After customizing the plist: cp scripts/ai.watson.knowledge-intake-poll.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/ai.watson.knowledge-intake-poll.plist ``` Or use OpenClaw to manage it — see `references/cron-setup.md`.
```bash # After customizing the plist: cp scripts/ai.watson.knowledge-intake-poll.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/ai.watson.knowledge-intake-poll.plist ``` Or use OpenClaw to manage it — see `references/cron-setup.md`.
X rotates refresh tokens on each use. The scripts: 1. Detect rotation (new token in response) 2. Save new token to `data/x-oauth2-new-refresh-token.txt` 3. Log a warning to update the plist env var Watson auto-detects and updates the secrets file. For non-Watson deployments, monitor for this warning and update `X_OAUTH2_REFRESH_TOKEN` in your env.
}
if (data.refresh_token && data.refresh_token !== REFRESH_TOKEN) {
console.log('⚠️ Refresh token rotated — update X_OAUTH2_REFRESH_TOKEN in plist');
fs.writeFileSync(
path.join(WORKSPACE, 'data/x-oauth2-new-refresh-token.txt'),
data.refresh_token,// Save new refresh token if rotated
if (data.refresh_token && data.refresh_token !== REFRESH_TOKEN) {
console.log('[bookmark-poll] ⚠️ Refresh token rotated — update X_OAUTH2_REFRESH_TOKEN in plist');
// Save to a file for the next run (protect with 0o600)
fs.writeFileSync(
path.join(WORKSPACE, 'data/x-oauth2-new-refresh-token.txt'),Discord #knowledge-intake (structured card)
│
▼
X API DELETE /bookmarks/:id (unbookmark)
```
## Prerequisites65/65 vendors flagged this skill as clean.