X Manual Surf Notes (手动刷帖笔记)

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is designed for manual browser-driven X (Twitter) surfing and note-taking. It uses OpenClaw's `browser` tool to automate interactions on X.com, extract information, translate it, and append it to a specific markdown file (`/home/makai/.openclaw/workspace/projects/x-ai-surf/x-ai-notes.md`). The `SKILL.md` instructions are clear and align with the stated purpose, detailing browser navigation, content extraction, and local file writing. The JavaScript snippets in `references/browser-scrape-snippets.md` are standard DOM manipulation for web content extraction. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's core function or access unrelated sensitive data.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may navigate and read content in the attached X browser tab while the workflow runs.

Why it was flagged

The workflow directs the agent to control a browser tab, scroll, open X posts, and extract visible page content. This is central to the skill's purpose and is disclosed, but users should understand the browser automation being granted.

Skill content
使用 `browser` 工具,`profile="chrome"` ... 下滑加载 ... 逐条点进详情 ... 抓取:作者、时间(datetime)、正文
Recommendation

Attach only the intended X tab, supervise initial runs, and avoid using the relay on unrelated sensitive pages.

What this means

The agent can view X content available to your logged-in account, including personalized recommendations.

Why it was flagged

The skill depends on the user's logged-in X session to access the personalized For You feed. This is expected for the purpose and no credential extraction or account mutation is shown.

Skill content
用户已登录 X(否则 For You 没意义/内容不完整)
Recommendation

Use it only if you are comfortable having the agent process your logged-in X feed, and do not run it on accounts or tabs containing content you do not want summarized.

What this means

Your personalized X feed observations may remain in a local notes file across sessions.

Why it was flagged

The skill persists collected X post summaries to a local markdown file and reuses prior entries for deduplication across runs. This is disclosed and proportional to the note-taking workflow.

Skill content
追加到:`/home/makai/.openclaw/workspace/projects/x-ai-surf/x-ai-notes.md` ... 同批次、跨批次都不重复写
Recommendation

Review the output path, retention expectations, and file permissions before using it for sensitive or private feed content.