x-reader通用内容抓取

Universal content reader for WeChat/Bilibili/Twitter/YouTube/Xiaohongshu. Use when you need to fetch full article content from platforms that block simple HT...

Security Scan

The instructions claim a simple universal reader but reference many undeclared dependencies (Playwright, yt-dlp, Telethon, Jina, Groq Whisper), saved browser sessions, and an OBSIDIAN_VAULT path — the skill underreports what it needs and where it stores data.

Purpose & Capability

The name/description (universal content reader) is plausible, but the SKILL.md references numerous specific components (Playwright browser fallback, Jina, yt-dlp, Groq Whisper, Telethon, feedparser, a Python venv and CLI) that are not declared in the registry metadata. Those components imply additional permissions, binaries, and credentials that a simple instruction-only reader should have declared.

Instruction Scope

Runtime instructions instruct creating a browser session for platform logins (e.g., 'x-reader login xhs') and reference saving sessions for a browser fallback and an Obsidian vault path. That implies the agent will create and read local session files and may persist content to a user-specified vault — behavior not made explicit in the skill metadata and broader than a minimal fetch operation.

Install Mechanism

No install spec is provided (instruction-only), which reduces install-time risk, but the SKILL.md explicitly describes a Python venv and CLI paths where the tool is expected to be installed. The lack of an install script or declared package sources makes it unclear how those components get onto the system.

Credentials

The doc references an OBSIDIAN_VAULT env var and implies saved browser sessions and use of services (Telegram via Telethon, Groq models) that normally require API keys or credentials. Yet the skill declares no required env vars, credentials, or config paths — an under-declaration that could hide where sensitive tokens or cookies are stored or needed.

Persistence & Privilege

The skill is not 'always' enabled and is user-invocable. However, it states it will create a persistent venv and save browser sessions (cookies) and may write outputs to an Obsidian vault path. Those persistent artifacts and session files are within the agent environment and should be explicitly disclosed.

What to consider before installing

This skill's README describes multiple components (Playwright, yt-dlp, Telethon, Jina, Groq Whisper), saved browser sessions, and an OBSIDIAN_VAULT path but declares no installs, binaries, or required credentials. Before installing or running it, ask the publisher for: (1) the full install steps and package sources (pip package name, GitHub release, etc.); (2) a list of required binaries and Python packages; (3) exactly what files/paths are created and where session cookies or tokens are stored; (4) what environment variables or API keys are required (Telegram, Groq, YouTube cookies, etc.); (5) whether any data is sent to third-party services. If you can't get that, run it only in a disposable sandbox or avoid installing it. If you proceed, inspect the created venv and session files and do not reuse sensitive credentials without reviewing code.

x-reader

Universal content reader — fetch and digest content from 7+ platforms.

Installation

# Python venv: ~/.openclaw/venv-xreader
# CLI path: ~/.openclaw/venv-xreader/bin/x-reader

Environment Setup

Obsidian vault path is configured via environment variable:

OBSIDIAN_VAULT=~/Library/Mobile Documents/com~apple~CloudDocs/MyVault

Usage

# Basic fetch
x-reader <url>

# Multiple URLs
x-reader <url1> <url2>

# Login to platform (saves session for browser fallback)
x-reader login xhs

# Show inbox
x-reader list

# Clear inbox
x-reader clear

Supported Platforms

Platform	Text Fetch	Video Transcript
WeChat (微信公众号)	Jina → Playwright fallback	—
Bilibili (B站)	API	via skill
X / Twitter	Jina → Playwright	—
YouTube	Jina + yt-dlp subtitles	Groq Whisper
Xiaohongshu (小红书)	Jina → Playwright + session	—
Telegram	Telethon	—
RSS	feedparser	—
Any web page	Jina	—

For WeChat Articles

WeChat public accounts require Playwright browser fallback. Run once:

x-reader login xhs  # creates browser session

Then fetch WeChat articles normally:

x-reader https://mp.weixin.qq.com/s/abc123

As Python Library

import asyncio
from x_reader.reader import UniversalReader

async def main():
    reader = UniversalReader()
    content = await reader.read("https://mp.weixin.qq.com/s/abc123")
    print(content.title)
    print(content.content[:200])

asyncio.run(main())

CLI Path

~/.openclaw/venv-xreader/bin/python — Python with x-reader installed ~/.openclaw/venv-xreader/bin/x-reader — x-reader CLI