X Growth Operator / X 增长运营助手

Plan and execute mission-driven X growth operations / 任务驱动的 X 增长运营规划与执行。Use when the user wants to monitor KOL posts, detect emerging discussions, turn brief...

Security Scan

The skill's requests (binaries, env vars, install) match its stated purpose of drafting, scoring, and—with explicit approval—posting to X; nothing in the bundle appears to ask for unrelated credentials or hidden endpoints.

Purpose & Capability

Name/description (X growth operations) align with required items: python3 + node/npm are needed for the provided Python workflows and the Node-based X CLI; the four X OAuth env vars are exactly what a client calling X API would require. Required config path (scripts/.env) is a reasonable place to store credentials for a CLI workflow.

Instruction Scope

SKILL.md explicitly documents the CLI steps the agent will run (Python scripts and npm-installed Node CLI), the local paths used (data/, scripts/.env), and network targets (api.twitter.com, api.x.com, optional Desearch). The instructions do not direct the agent to read unrelated system files or exfiltrate data to unknown external endpoints; the flow is review-first and requires explicit approval for live posting.

Install Mechanism

Install step is a local 'cd scripts && npm install' pulling standard Node packages (commander, dotenv, proxy agents). There are no arbitrary URL downloads, archive extraction, or unusual install locations in the manifest.

Credentials

Declared env vars are the four X OAuth credentials (X_API_KEY, X_API_SECRET, X_ACCESS_TOKEN, X_ACCESS_TOKEN_SECRET) and an optional DESEARCH_API_KEY for live search—these are proportionate and expected for the stated features. The skill uses a local scripts/.env file for configuration, which is consistent with the instructions.

Persistence & Privilege

The skill does not request 'always: true' and is user-invocable. It writes state to its own data/ directory and scripts/.env and does not appear to modify other skills or system-wide agent settings. The dashboard binds to 127.0.0.1 and is local.

Assessment

This skill is internally consistent with its X-growth purpose, but it will accept and use your X OAuth credentials and can perform live posts when you run it in x-api mode and supply explicit approval. If you plan to install/run it: (1) review scripts/x_oauth_cli.js (and other Node scripts) to confirm they call only official X endpoints you expect; (2) keep credentials in a secure, limited-permission environment (scripts/.env) and do not expose them publicly; (3) be aware 'npm install' will pull dependencies from the registry—run in an isolated or monitored environment if you require extra assurance; (4) the skill documents and enforces a review-first workflow, but always check proposed actions before approving live execution. If you want higher assurance, ask the author for an integrity-signed release or run the tool in an isolated container/VM.

Use this skill when the user wants a review-first workflow for X operations rather than a generic writing assistant.

Purpose

Turn a user brief into an X growth mission, infer what the account should watch, find relevant opportunities, draft actions, and execute approved posts with an audit trail.

Security & Runtime Declaration

• This skill can perform real authenticated X actions only in x-api mode and only after explicit approval.
• Required environment variables for real X execution:
  • X_API_KEY
  • X_API_SECRET
  • X_ACCESS_TOKEN
  • X_ACCESS_TOKEN_SECRET
• Optional environment variable:
  • DESEARCH_API_KEY (needed only for live Desearch search/import)
• Install step required before real execution:
  • cd scripts && npm install
• Network targets used by this skill:
  • https://api.twitter.com
  • https://api.x.com
• Local persistence paths:
  • data/
  • scripts/.env

Trigger Conditions

Use this skill when the user asks to:

• operate or grow an X account
• monitor KOLs, keywords, or emerging discussions
• react to breaking events on X
• draft replies, quote posts, or original posts for X
• create or update a mission from a brand brief or uploaded document
• test an autonomous-but-reviewed X growth workflow in OpenClaw

Workflow

Run these steps in order unless the user explicitly asks for one step only.

1. Build or refresh the mission:

python3 scripts/ingest_goal.py \
  --doc examples/brand_brief.md \
  --mission data/mission.json

You may also pass --prompt instead of --doc.

The brief can be structured with explicit sections or written as freeform natural language. The parser should infer goals, audience, topics, constraints, CTA, and risk tolerance from either format.

2. Gather opportunities:

python3 scripts/watch_x.py \
  --mission data/mission.json \
  --input examples/opportunities.json \
  --output data/opportunities_scored.json

Import live opportunities with Desearch:

python3 scripts/import_desearch.py \
  x "your query here" \
  --count 10 \
  --output data/opportunities_from_desearch.json

Or run live search all the way to an action plan:

python3 scripts/live_search_and_plan.py \
  --mission data/mission.json \
  --count 10

If --query is omitted, derive the search query from mission topics, keywords, and audience.

If the operator is manually surfing X and taking notes, convert those notes first:

python3 scripts/import_surf_notes.py \
  --notes examples/surf_notes.md \
  --output data/opportunities_from_notes.json

3. Draft a recommended action:

python3 scripts/propose_action.py \
  --mission data/mission.json \
  --opportunities data/opportunities_scored.json \
  --opportunity-id YOUR_OPPORTUNITY_ID \
  --output data/action.json

4. Execute only after explicit user approval:

python3 scripts/execute_action.py \
  --mission data/mission.json \
  --action data/action.json \
  --log data/execution_log.jsonl

For reply and quote_post, execution should run the preflight gate first. It inspects the target tweet's reply settings and blocks likely permission failures before posting.

For real X execution, first install Node dependencies and configure X OAuth credentials, then run:

python3 scripts/check_env.py --mode execution
python3 scripts/execute_action.py \
  --mission data/mission.json \
  --action data/action.json \
  --log data/execution_log.jsonl \
  --approved \
  --mode x-api

5. Build a ranked action plan from the current opportunity set:

python3 scripts/plan_actions.py \
  --mission data/mission.json \
  --opportunities data/opportunities_scored.json \
  --output data/action_plan.json

6. Learn from feedback and refresh memory:

python3 scripts/review_feedback.py \
  --mission data/mission.json \
  --feedback examples/feedback.json \
  --memory data/memory.json \
  --output data/feedback_report.json

7. Run the whole cycle in one command when testing:

python3 scripts/run_cycle.py \
  --doc examples/brand_brief.md \
  --opportunities examples/opportunities.json \
  --feedback examples/feedback.json

Rules

• Default to review mode. Do not execute posts or replies until the user clearly approves the final action.
• For reply and quote_post, honor the interaction preflight result unless the user explicitly chooses to bypass it.
• If the user provides a document, parse it into mission fields first instead of drafting content immediately.
• Treat the mission as the source of truth for content direction. Do not assume the account is about OpenClaw, agents, or developer tools unless the user brief says so.
• If no live X source is available, operate on imported JSON opportunities and keep the workflow moving.
• Prefer replies and quote posts over net-new posts when the opportunity is time-sensitive.
• Downrank or reroute interaction ideas when thread structure or reply settings suggest a likely permission failure.
• Reject actions that conflict with mission constraints, banned topics, or risk thresholds.
• When confidence is low, recommend observe instead of forcing an action.
• Persist what worked. Use data/memory.json to carry forward successful angles, source accounts, and action types.
• Treat auto execution as future work. This skill is review-first.
• Real X execution requires X_API_KEY, X_API_SECRET, X_ACCESS_TOKEN, and X_ACCESS_TOKEN_SECRET.

Resources

• examples/brand_brief.md: sample source document for mission ingestion
• examples/freeform_brief.md: sample freeform brief for mission ingestion
• examples/opportunities.json: sample X opportunities for local testing
• examples/feedback.json: sample outcome data for memory updates
• examples/surf_notes.md: sample manual browser-surf notes
• examples/desearch_query.txt: sample live search query
• references/mission-schema.md: field meanings and scoring rules
• scripts/.env.example: example execution environment file

Outputs

• data/mission.json: structured mission for later turns
• data/opportunities_scored.json: ranked opportunities with reasons
• data/action_plan.json: ranked next actions for the current cycle
• data/action.json: one reviewed action proposal
• data/execution_log.jsonl: append-only execution history
• data/memory.json: persistent learned patterns and historical outcomes