Leo X Post

专为Leo定制的X（Twitter）发帖技能。用于发推文、带附件、回复或定时发布。触发当用户说'用leo-x-post发推'或类似，处理X API交互。需要用户提供API密钥。别用于历史数据或复杂分析。

Security Scan

The skill's description says it posts to X using a Python script and API keys, but the bundle contains only an instruction file that references missing scripts and reference docs, and it does not declare the API credential or installation steps — these inconsistencies are suspicious.

Purpose & Capability

The skill's stated purpose (posting to X/Twitter via tweepy and a post_to_x.py script) would legitimately require an API key and a Python environment with tweepy, but the registry metadata lists no required environment variables, no primary credential, and no required binaries. That mismatch (needing an API key in prose but not declaring it) is incoherent.

Instruction Scope

The SKILL.md instructs the agent to run scripts/post_to_x.py and to follow references/auth.md and references/errors.md, but the package contains only SKILL.md — the referenced scripts and docs are missing. The instructions also assume use of tweepy and an authentication guide, but give no concrete, declared way to supply credentials or install dependencies.

Install Mechanism

No install spec is provided (instruction-only), which is low-risk in principle, but problematic here because the instructions expect Python/tweepy and a post_to_x.py script that are not present. The skill should either include code or declare install steps; the absence creates ambiguity about what will actually run.

Credentials

The prose explicitly says an API key is needed, but requires.env and primary credential fields are empty. That omission prevents review of what exact secrets will be requested at runtime and is disproportionate to what is declared in metadata.

Persistence & Privilege

The skill is not always-enabled and allows normal autonomous invocation (disable-model-invocation: false), which is the platform default. There is no indication the skill requests elevated persistence or modifies other skills.

What to consider before installing

Do not install or enable this skill yet. It references a Python script and auth/docs that are not included and it claims to need an X API key but does not declare which environment variable or secret it will consume. Ask the publisher for: (1) the actual scripts (post_to_x.py and reference docs) so you can review the code, (2) an explicit list of required environment variables and how they are used, and (3) installation steps (e.g., pip install tweepy) or a packaged release. Only provide API credentials after you have reviewed the script to ensure it only calls the official X API endpoints and does not transmit your keys elsewhere. If you can't obtain the code or a trustworthy source, treat the skill as untrusted.

Overview

这个技能帮Leo快速发X帖，简单高效。核心是post_to_x.py脚本，用tweepy库调用API。

Workflow

1. 认证：用references/auth.md的指南设置API密钥。
2. 发帖：运行scripts/post_to_x.py --text "你的消息" --image "可选图片路径"。
3. 错误处理：见references/errors.md。

Resources

scripts/

• post_to_x.py：主脚本，发帖逻辑。

references/

• auth.md：认证步骤。
• errors.md：常见错误处理。