X Timeline Digest

• Outcome: Pass
• Latest audit: May 28, 2026, 1:45 AM
• Version:
  1.0.2

Overview

This skill does what it says: reads X timelines through a local authenticated bird session, builds a digest, and keeps limited local state.

Install only if you are comfortable letting the skill read your authenticated X timelines through bird. Use a trusted bird binary, review any upstream workflow that sends the digest elsewhere, and delete ~/.openclaw/state/x-timeline-digest.json if you want to reset stored digest history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill reads an authenticated X/Twitter timeline using an existing cookie-backed bird session and stores tweet-derived state on disk, but the documentation does not prominently warn users about that data access and persistence. This can lead to uninformed use in environments where operators do not expect authenticated account data to be accessed or retained locally, increasing privacy and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.