X Bookmark Triage
ReviewAudited by ClawScan on May 10, 2026.
Overview
This skill does what it advertises, but it needs powerful X, Discord, and Anthropic credentials and can automatically remove bookmarks, while the registry metadata does not declare those requirements.
Install only if you want an automated pipeline that reads your X bookmarks, sends content to Anthropic, posts summaries to Discord, and may remove bookmarks. Start with read-only or dry-run mode, restrict the Discord channel, use least-privilege bot/OAuth scopes, and verify all credential and scheduling settings before enabling background polling.
Findings (7)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If enabled, the skill can automatically clear bookmarks from your X account; mistakes may be hard to undo from X itself.
The scheduled poller deletes/unbookmarks X bookmarks after triage, and also deletes already-seen items, without a per-bookmark confirmation step.
if (bookmark.tweetId && userId) { const deleted = deleteBookmark(accessToken, userId, bookmark.tweetId);Use a dry run or read-only OAuth scope first, and only grant bookmark.write if you are comfortable with automatic unbookmarking.
A user relying on registry metadata may not realize this skill needs tokens that can read and modify X bookmarks, post to Discord, and spend Anthropic API quota.
The registry metadata does not declare credentials, while the README and scripts require multiple sensitive credentials for X, Discord, and Anthropic.
Required env vars: none; Primary credential: none
Declare all required environment variables and credentials in the package metadata, and document the minimum safe scopes clearly.
Granting write scope lets the skill remove bookmarks from your X account.
The requested X OAuth scopes are directly related to reading and optionally removing bookmarks, but bookmark.write is a powerful account permission.
Needs `bookmark.read` scope (+ `bookmark.write` to auto-unbookmark).
Prefer bookmark.read-only mode unless you specifically want the cleanup behavior.
Once scheduled, the skill may repeatedly read Discord messages or X bookmarks and post cards without a fresh prompt each time.
The skill documents recurring background polling via cron/launchd/systemd. This is disclosed and purpose-aligned, but it means the skill can keep acting after setup.
Schedule polling ... */2 * * * * cd /path/to/x-bookmark-triage && bash scripts/run-poll.sh
Only enable the scheduler after testing manually, and keep clear unload/disable instructions handy.
Untrusted web content can influence the generated knowledge card that may later be treated as part of your knowledge base.
Fetched tweet or web-page content is sent into the LLM prompt and then summarized into persistent Discord knowledge cards.
Content:\n${fetched.content.slice(0, 6000)}Treat generated cards as summaries of untrusted content and review important cards before relying on them.
Anyone who can post in the watched Discord channel may trigger URL triage and cause content to be sent to Anthropic and posted back to Discord.
The Discord poller reads channel messages and processes URLs from non-bot users in that channel.
const messages = fetchMessages(state.last_message_id);
Restrict the watched channel to trusted users and use a dedicated Discord bot with minimal permissions.
Users may follow setup instructions for a file that is absent or must be supplied from elsewhere.
The documentation references a launchd plist template that is not listed in the provided file manifest.
Edit scripts/ai.watson.knowledge-intake-poll.plist
Include the referenced template in the package or update the documentation to avoid setup ambiguity.