X Bookmarks

This package appears to do what it says, but take these precautions before installing: - Source verification: the skill's source/homepage is unknown and the registry metadata contradicts SKILL.md. Only install if you trust the publisher or have reviewed the scripts. - Prefer OAuth over manual cookie copying: use the provided x_api_auth.py flow (OAuth PKCE) rather than manually extracting/pasting auth_token and ct0 — copying cookies is sensitive and error-prone. - Review local storage: tokens are written to ~/.config/x-bookmarks/tokens.json (the code sets 0o600). Make sure you’re comfortable storing tokens on this machine and check file ownership/permissions. - Inspect scripts: the included scripts are small and call only bird or X API endpoints; if unsure, read them yourself or run in an isolated environment (VM/container) first. - Validate bird-cli source: if you use the bird path, ensure you install bird-cli from its official repo/npm package and understand that it accesses browser cookie stores. - Cron/automation: scheduled digests imply storing last-processed IDs in workspace/state — confirm where that state will be stored and secure it if it contains tokens or identifiers. If you want higher assurance, ask the publisher for a verified homepage or run the tools locally (inspect source and run only the Python scripts you reviewed).