X Articles

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent for drafting and publishing X Articles, but it can control a logged-in X browser to post publicly, so users should keep final publishing under manual review.

Install only if you are comfortable with an agent controlling a logged-in X browser. Review every article before publishing, keep the CDP browser session local and temporary, and install the required browser automation tool only from a trusted source.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If used carelessly, the agent could publish content publicly to the user's X account.

Why it was flagged

The skill documents browser automation that can publish and confirm an X Article. This is purpose-aligned, but it is a high-impact public action.

Skill content

agent-browser --cdp 18800 click @e35  # Publish button

# Confirm in dialog
agent-browser --cdp 18800 click @e5   # Confirm

Recommendation

Keep a human review step before publishing, and do not let the agent click Publish/Confirm unless the content and account are correct.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The agent can act as the logged-in X user while the browser is exposed through the CDP automation port.

Why it was flagged

The automation uses an already-authenticated X browser session, so actions are performed with the user's account privileges.

Skill content

- clawd browser running on CDP port 18800
- Logged into X on the browser

Recommendation

Use a dedicated browser profile or account when possible, close the CDP-enabled browser when not in use, and avoid exposing the CDP port to untrusted processes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing an untrusted or changed global CLI could give that tool browser-control capabilities.

Why it was flagged

The script depends on an external global CLI installation, and the suggested install command does not pin a version. This is expected for the browser-automation purpose but should be sourced carefully.

Skill content

Error: agent-browser not found. Install with: npm install -g agent-browser

Recommendation

Verify the agent-browser package source and version before installing, and prefer pinned or trusted installation methods.