Social Media Agent

Autonomous social media management for X/Twitter using only OpenClaw native tools. Use when a user wants to automate X posting, generate content, track engagement, or build an audience. Triggers on requests about tweets, social media strategy, X engagement, content calendars, or growing a following. No API keys required — uses browser automation and web_fetch.

Security Scan

The skill's instructions mostly match social-media automation, but it asks the agent to connect to a browser debugging session and to autonomously post — both grant far broader access than the description acknowledges.

Purpose & Capability

The declared purpose (automating X/Twitter via browser automation and scraping) matches the instructions: web_fetch for research, browser actions to compose/post, and memory for drafts/logs. Requiring no API keys is coherent because browser automation can operate on logged-in sessions. However, the skill implicitly expects access to a browser debugging endpoint (or OpenClaw's built-in browser), which is a powerful mechanism for accomplishing the stated goal and is not called out in the metadata.

Instruction Scope

The SKILL.md explicitly instructs connecting to Chrome with remote debugging OR using the built-in browser, taking snapshots, finding input elements, typing, clicking, and scheduling autonomous posts. Those steps require interacting with a live browser session and can access cookies, auth tokens, and other logged-in accounts. The instructions also encourage autonomous scheduled posting (cron + sessionTarget: 'isolated' + payload.kind: 'agentTurn'), which could lead to actions executed without further user confirmation.

Install Mechanism

Instruction-only skill with no install spec and no code files. That minimizes disk write/execution risk. Nothing is downloaded or installed by the skill itself.

Credentials

No environment variables or credentials are requested, which at first glance is least-privileged. However, the instruction to use Chrome remote debugging (or a built-in browser) is an effective request for high-privilege access to the user's browser environment — access that can expose session cookies, tokens, and other accounts. This broad capability is not reflected in requires.env or other metadata and so is disproportionate to the innocuous description.

Persistence & Privilege

always:false (good), but the skill explicitly prescribes autonomous scheduling and isolated agent turns for posting. Autonomous invocation combined with browser-level access increases the blast radius: the agent could repeatedly post or interact without per-action user confirmation. The skill does not request persistent system configuration changes, nor does it modify other skills.

What to consider before installing

This skill appears to do what it says (automate X posts via browser automation), but it relies on connecting to a browser debugging session or using a built-in browser — that effectively gives the agent broad access to any accounts or cookies in that browser. Before installing or enabling it, consider: - Only allow the skill to control a browser profile or instance you explicitly dedicate to automation (preferably a throwaway/test account), not your primary browser profile. - Avoid enabling Chrome remote debugging on a browser that holds other logins. If remote debugging is required, limit it to a controlled instance and close it when not in use. - Require manual confirmation for each publish action (do not rely solely on scheduled autonomous posts) until you trust the skill. - Review and test in a disposable account to confirm behavior and that it doesn't access other sites or data. - Be aware of platform terms of service: browser automation that scrapes or automates actions can violate X/Twitter rules. Given these combined concerns (browser-level access + autonomous posting), treat the skill as suspicious unless you can constrain its browser access and require explicit user approvals for posting.

Manage an X/Twitter account autonomously using only OpenClaw's built-in tools. No external APIs, no npm packages, no API keys needed.

Core Tools

• browser — Post tweets, engage with posts, take screenshots
• web_fetch — Scrape profiles, trending topics, news for content
• sessions_spawn — Run content generation in parallel
• cron — Schedule regular posting and engagement
• memory_search / files — Track what was posted, engagement stats

Posting a Tweet

1. Ensure Chrome is running with remote debugging OR use OpenClaw's built-in browser
2. Navigate to x.com/compose/post
3. Take a snapshot to find the text input
4. Type the tweet text
5. Click the Post button
6. Verify with another snapshot

browser open → x.com/compose/post
browser snapshot → find textbox ref
browser act → click textbox ref
browser act → type tweet text
browser snapshot → find Post button ref
browser act → click Post button

Important timing: Wait 3-4 seconds after page loads before interacting.

Content Generation Strategy

Content Pillars

Rotate through these categories for balanced content:

Pillar	%	Examples
Industry Insights	40%	AI news commentary, tech analysis
Building in Public	30%	Progress updates, behind-the-scenes
Philosophy/Thought	20%	Hot takes, provocative questions
Engagement/Humor	10%	Memes, replies, community interaction

Content Pipeline

1. Research: Use web_fetch on news sites (theverge.com, techcrunch.com, news.ycombinator.com)
2. Generate: Spawn a content-agent via sessions_spawn with research results
3. Store: Save drafts in memory/tweet-drafts-YYYY-MM-DD.json
4. Review: Check drafts for quality, brand consistency
5. Post: Use browser automation to publish
6. Track: Log posted tweets in memory/social-log.json

Draft Format

{
  "text": "Tweet text under 280 chars",
  "topic": "What it's about",
  "hook": "Why it might engage"
}

Engagement Strategy

Posting Rules

• Max 3-5 tweets per day — Quality over quantity
• Min 45 seconds between actions — Avoid rate limiting
• No spam — Genuine engagement only
• Track everything — Log all posts and engagement

Growing Followers

1. Post consistently (daily)
2. Engage with relevant accounts (reply, quote tweet)
3. Use trending topics when relevant
4. Be authentic — no generic AI responses

Scheduling with Cron

Set up automated posting schedules:

Morning post: cron expr "0 9 * * *" — Industry insight
Afternoon post: cron expr "0 15 * * *" — Building update
Evening post: cron expr "0 21 * * *" — Hot take

Use sessionTarget: "isolated" with payload.kind: "agentTurn" for autonomous posting.

Anti-Patterns (Avoid)

• Do NOT post more than 5 tweets per day (looks spammy)
• Do NOT use generic engagement ("Great post!" "So true!")
• Do NOT post without reading the content you're commenting on
• Do NOT use API keys when browser automation works
• Do NOT build external tools when OpenClaw native suffices

Analytics Tracking

Track engagement in memory/social-log.json:

{
  "date": "2026-02-08",
  "posted": 3,
  "platform": "x",
  "handle": "@YourHandle",
  "tweets": [
    {"text": "...", "time": "09:00", "topic": "ai-news"}
  ]
}

Review weekly: What topics got most engagement? Adjust strategy accordingly.

Quick Reference

For detailed content templates and examples, see references/content-templates.md.