twitter browser post

Monitora posts novos de Tom Doerr no X.com, verifica links GitHub reais, traduz, solicita aprovação e publica no Twitter automaticamente.

Security Scan

The skill's instructions mostly match a monitoring-and-posting task, but it relies on undeclared authenticated contexts (browser profile / Telegram / X session) and scheduling which are not represented in the metadata — that mismatch warrants caution.

Purpose & Capability

The name/description (monitor Tom Doerr posts, verify GitHub links, translate, request approval, post on X) aligns with the runtime steps in SKILL.md. However, the SKILL.md assumes an authenticated browser profile ('openclaw' profile), access to Telegram channels, and the ability to post on X.com without declaring any required credentials or config paths in the manifest — a platform-level dependency that is not documented in the skill metadata.

Instruction Scope

Instructions are detailed and narrowly scoped to: open a browser profile, read the most recent X post, confirm real GitHub links (t.co redirect or GitHub search), translate/rewrite, send for Telegram approval, and post via X compose dialog using explicit DOM refs. They reference agent memory files (memory/rotinas.md, memory/instrucoes-tom-doerr.md) and include a cron command. They do not instruct collecting unrelated system files or environment variables, nor do they exfiltrate data to unexpected endpoints.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing will be downloaded or written during install by the skill itself. That lowers install-time risk.

Credentials

The skill requires capabilities that imply credentials/active sessions (posting to X, sending to Telegram, using a specific browser profile) but declares no required environment variables or config paths. The manifest omits any mention of the need for an authenticated browser profile or Telegram/X tokens; relying on an already-logged-in browser profile or platform-provided Telegram channel is plausible but is a security-relevant assumption that should be explicit.

Persistence & Privilege

The skill does not set always:true and is user-invocable, which is normal. It includes a recommended cron command to schedule hourly checks via platform tooling (openclaw cron add) — creating such scheduled jobs grants the skill recurring execution ability if the user runs that command. Autonomous invocation plus scheduling increases the impact of any mistakes or misconfigurations, so users should be aware the skill can act regularly once scheduled.

What to consider before installing

This skill appears to do what it says, but it assumes an already-authenticated environment (a browser profile capable of posting on X and a Telegram channel/user) without declaring those requirements. Before installing or enabling automated runs: (1) Confirm where the X and Telegram authentication comes from — are you relying on a logged-in 'openclaw' browser profile or platform-managed channels? (2) Inspect memory/rotinas.md and memory/instrucoes-tom-doerr.md to ensure they contain no sensitive tokens or unwanted history the skill will read or overwrite. (3) Don't schedule the cron job until you test a manual run and verify the Telegram approval step works as intended (so it won't post without human consent). (4) Ask the publisher/source for a homepage or source code to verify behavior. (5) If you prefer safety, run it manually (user-invoked) and avoid installing the cron job or granting any persistent credentials until you trust the workflow.

Monitor Tom Doerr

Workflow para monitorar posts do Tom Doerr no X.com e compartilhar repositórios interesantes.

Processo Completo

1. Verificar novos posts

1. Abrir browser (se não estiver aberto): openclaw browser --browser-profile openclaw start
2. Navegar para https://x.com/tom_doerr
3. Verificar o primeiro post (mais recente)
4. Comparar ID com último post salvo em memory/rotinas.md

2. Verificar link do GitHub (CRÍTICO!)

Dois métodos para descobrir o link real:

Método 1 (recomendado): Usar o link t.co do post

1. No browser, clicar no link do post (o link encurtado t.co)
2. Ver para onde redireciona no URL do navegador
3. Exemplo: t.co/nDOuPnyZXv → github.com/afterxleep/agents

Método 2: Buscar no GitHub

1. Acessar o usuário/organização no GitHub (ex: github.com/afterxleep)
2. Buscar o repo correto pelo nome ou descrição
3. Confirmar o nome exato do repo

Por que isso é importante:

• O X mostra links truncados/encurtados no texto do post
• O link real pode ser diferente do mostrado!
• Exemplos de erros passados:
  • ❌ Errado: github.com/afterxleep/age (não existe)
  • ✅ Certo: github.com/afterxleep/agents (existe!)
  • ❌ Errado: github.com/Yqnn/svg-path- (truncado)
  • ✅ Certo: github.com/Yqnn/svg-path-editor (existe!)

3. Traduzir e reescrever para alcance

• Traduzir para português brasileiro
• Usar emojis relevanetes
• Adicionar hashtags: #IA #GitHub #Tech #OpenSource
• Descrição chamativa

4. Enviar para aprovação (Telegram)

• Primeiro enviar para o Telegram do Gabriel
• Esperar aprovação antes de postar no X

5. Postar no X (se aprovado)

⚠️ PASSO A PASSO CORRETO (testado em 2026-03-06):

1. Acessar https://x.com/compose/post
2. Esperar a página carregar completamente (dialog precisa aparecer)
3. No dialog que abre:
   • Textbox do post: ref=e93 (dentro do dialog)
   • Botão Post: ref=e170 (dentro do dialog, não o da timeline principal!)
4. Digitar o texto usando kind: "type" no textbox ref=e93
5. AGUARDAR o botão Post ficar habilitado (cursor=pointer, não disabled)
6. FECHAR qualquer listbox/overlay com Escape antes de clicar
7. Clicar no botão Post (ref=e170) com kind: "click"
8. VERIFICAR se o post apareceu na timeline (confirma sucesso)

Estrutura da página (importante!):

- dialog (ref=e20)
  - textbox "Post text" (ref=e93) ← DIGITAR AQUI
  - button "Post" (ref=e170) ← CLI AQUI (dentro do dialog!)

🔑 Pontos críticos aprendidos (2026-03-06):

• O dialog tem sua própria textbox (ref=e93) e botão Post (ref=e170)
• NÃO usar os elementos da timeline principal (outro textbox e botão)
• Sempre fechar listboxes de hashtags com Escape antes de clicar Post
• Se o click não funcionar, tentar pressionar Enter apósdigitar
• Snapshot mostra a estrutura completa - usar refs corretos do dialog

Se automação falhar:

• Enviar msg no Telegram pedindo para postar manualmente
• O texto já está pronto para colar

Arquivos de referência

• Último post enviado: memory/rotinas.md
• Instruções detalhadas: memory/instrucoes-tom-doerr.md

Cron Job

O monitoramento automático roda a cada 1 hora via:

openclaw cron add --name "monitor-tom-doerr" --every 1h --message "..." --channel telegram --to 1225303431 --announce