Security audit
OpenClaw X Plugin
Security checks for vulnerabilities and agentic risk
Overview
This plugin legitimately connects OpenClaw to X/Twitter for account reads, local draft management, approved publishing, and explicit media uploads, with the sensitive behavior disclosed.
Install only if you intend to let OpenClaw manage an X/Twitter account with your own X developer app credentials. Keep the configured session file private because it can contain OAuth access and refresh tokens, use stable state paths outside the plugin install directory, verify the intended accountId before approving or publishing, and remember that x_media_upload sends the specified local file to X immediately.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.