Twitter Agent

AI+Crypto Twitter automation agent. Post tweets, reply to KOLs, and quote tweet trending content. Integrates with opentwitter/opennews (6551) for hot topic f...

Security Scan

The skill's code, environment requirements, and runtime instructions match its stated purpose (automating Twitter/X posting using tweepy and an external 6551 service for topic discovery).

Purpose & Capability

The skill is a Twitter automation agent and requires Twitter OAuth keys and tokens; the included Python scripts use those exact credentials and tweepy to post/reply/quote. The extra TWITTER_TOKEN is used by SKILL.md to call the 6551 API for trending content, which fits the stated 'hot topic fetching' capability.

Instruction Scope

SKILL.md expects the agent to exec shell commands (run the provided Python scripts and curl calls). That is normal for an operational skill but gives the agent the ability to perform those shell calls autonomously. The only external network endpoints referenced are developer.x.com (docs), api endpoints at ai.6551.io (for topic fetch), and standard Twitter/X APIs; the scripts themselves only read the declared Twitter env vars and do not attempt to read other system files.

Install Mechanism

The package is instruction-only in the registry, but SKILL.md includes an 'install' entry to pip-install tweepy. Using pip to install the well-known 'tweepy' package is proportionate. No downloads from untrusted URLs or archive extraction are present. Slight inconsistency: registry metadata reported 'No install spec' while SKILL.md declares a pip install; this is likely benign but worth noting.

Credentials

The required env vars are the four Twitter OAuth 1.0a credentials (consumer key/secret and access token/secret) plus a TWITTER_TOKEN for the 6551 service; each is justified by the skill's functions (posting/replying/quote needs write credentials; trending fetch needs 6551 token). No unrelated credentials or unexplained secret access is requested.

Persistence & Privilege

Skill is not always-included (always: false) and is user-invocable; it does not request system config paths or modify other skills. Autonomous invocation is allowed (disable-model-invocation:false) which is the platform default — acceptable here but remember it lets the agent run the scripts without further prompts.

Assessment

This skill appears internally consistent: it needs your Twitter OAuth keys (read+write) so it can post/reply/quote on your behalf, and it needs a TWITTER_TOKEN to call the ai.6551.io service for trending content. Before installing: 1) ensure you trust the 6551 service (ai.6551.io) because the skill will send requests to it using your TWITTER_TOKEN; 2) be aware the skill will have write access to your Twitter account — only install if you trust the skill and its operator; 3) credentials should be stored securely and you should be prepared to revoke them if unexpected posts appear; 4) note SKILL.md requires the agent to exec shell commands (run scripts and curl), which is necessary for operation but gives the agent the ability to perform those network and file actions; and 5) there is a minor metadata inconsistency about install instructions (SKILL.md asks to pip-install tweepy) — confirm OpenClaw will install that dependency or install it yourself before use.

Twitter Agent Skill

IMPORTANT: Use the exec tool to run all commands below. Do NOT just display them.

Automates Twitter/X operations for an AI+Crypto account: post original tweets, reply to KOLs, and quote tweet trending content.

Prerequisites

You need:

1. Twitter Developer Account — get API keys at https://developer.x.com
2. 6551 API Token (TWITTER_TOKEN) — get at https://6551.io/mcp (for hot topic fetching)

When installing, OpenClaw will prompt you to fill in each env variable.

Required env vars

Variable	Where to get
TW_CONSUMER_KEY	developer.x.com → Your App → OAuth 1.0a Keys
TW_CONSUMER_SECRET	developer.x.com → Your App → OAuth 1.0a Keys
TW_ACCESS_TOKEN	developer.x.com → Your App → Generate (Read+Write)
TW_ACCESS_TOKEN_SECRET	developer.x.com → Your App → Generate (Read+Write)
TWITTER_TOKEN	https://6551.io/mcp

Important: Set your Twitter App permissions to Read and Write before generating the Access Token.

---

Operations

1. Post a tweet

python3 $SKILL_DIR/scripts/twitter_post.py --text "Your tweet text (max 280 chars)"

With image:

python3 $SKILL_DIR/scripts/twitter_post.py --text "Tweet text" --image /path/to/image.png

2. Reply to a tweet

python3 $SKILL_DIR/scripts/twitter_reply.py --tweet_id "TWEET_ID" --text "Your reply"

3. Quote tweet

python3 $SKILL_DIR/scripts/twitter_quote.py --tweet_id "TWEET_ID" --text "Your comment"

---

Full AI+Crypto workflow

Step 1 — Fetch trending tweets (via 6551 opentwitter)

curl -s -X POST "https://ai.6551.io/open/twitter_search" \
  -H "Authorization: Bearer $TWITTER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"keywords": "AI crypto", "minLikes": 500, "product": "Top", "maxResults": 10}'

Fetch KOL tweets:

curl -s -X POST "https://ai.6551.io/open/twitter_user_tweets" \
  -H "Authorization: Bearer $TWITTER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username": "VitalikButerin", "maxResults": 5}'

Step 2 — Generate content (Agent handles this)

Based on trending tweets, generate one of:

• Original tweet: Insightful AI/Crypto take, ≤280 chars
• Reply: Unique perspective, not robotic, ≤120 chars
• Quote: One punchy line that adds value

Guidelines:

• Write in English (target: English-speaking Crypto/AI community)
• Have a real opinion, avoid generic takes
• Max 1–2 emojis

Step 3 — Publish

Call the appropriate script from Step 1 above.

---

Output format

All scripts return JSON:

{
  "success": true,
  "tweet_id": "1234567890",
  "url": "https://x.com/username/status/1234567890",
  "text": "Published content"
}

---

Rate limit notes

• Free tier: 1,500 tweets/month write limit
• Recommended intervals: ≥10 min between posts, ≥5 min between replies
• Avoid replying to the same account many times in a short window