⁠X Reader⁠

Read and summarize X/Twitter links with low-token routing. Use when a user shares an x.com/twitter.com/t.co link or asks to read, summarize, extract, or insp...

Security Scan

The skill's purpose (reading and summarizing X links) matches its behavior, but it quietly requires local X auth cookies and an external 'xreach' CLI that are not declared in the registry metadata — these omissions and the use of browser automation make the package's requirements and privileges inconsistent and worth caution.

Purpose & Capability

The skill claims to read X/Twitter links and avoid the official API, which fits the included code. However, the runtime spawns an external 'xreach' CLI via execFile('xreach', ...), yet the registry metadata lists no required binaries and the package.json does not install or declare an 'xreach' dependency. SKILL.md does mention 'xreach' as a dependency, but the manifest omission is an incoherence: a user installing this skill must also install/obtain xreach separately for normal operation.

Instruction Scope

The SKILL.md and script instruct the agent to read local auth files (~/.config/xreader/session.json and legacy ~/.config/xfetch/session.json) and migrate/create a session file. Accessing and writing X auth cookies is sensitive but relevant to the stated purpose; however the registry metadata did not declare these required config paths. The script also uses network fetches and Playwright page evaluation (including running a headless/headed browser) which are expected for article extraction but expand the runtime surface.

Install Mechanism

There is no automated install spec in the registry, but SKILL.md explicitly instructs running `npm install` in the skill directory to obtain Playwright. Playwright (and its browsers) are heavyweight but legitimate for article rendering. No downloads from arbitrary URLs are present in the package files; the install flow is manual and documented, which lowers risk but requires user action.

Credentials

The skill requires valid X auth cookies (authToken and ct0) stored in the user's home config paths; this is proportionate to cookie-based scraping but is sensitive. The registry metadata declared no required config paths or credentials, creating a mismatch between what the skill actually needs and what was advertised. No unrelated credentials are requested, but the omission of declared config paths is notable.

Persistence & Privilege

The skill does write its own config (~/.config/xreader/session.json) and will migrate a legacy file if present; it does not request always:true, does not modify other skills or system-wide agent settings, and operates within its own config directory. This is expected behavior for a cookie-using tool.

What to consider before installing

This skill largely does what it says (reads tweets, threads, and X articles), but there are a few things to check before installing: - Expectation gap: The script requires an external 'xreach' CLI at runtime but the registry metadata/package.json do not declare or install it; install or inspect xreach yourself before relying on the skill. - Sensitive data: The skill reads and will write X login cookies at ~/.config/xreader/session.json (and will migrate ~/.config/xfetch/session.json). Only provide cookie files from accounts you are willing to expose to automation — consider a secondary account. - Playwright: The skill uses Playwright for article extraction; running npm install will fetch Playwright and browser binaries (large, with elevated I/O). Review and run npm install in a controlled environment if you have concerns. - Verify behavior: Inspect the xreader.mjs script (already included) and the xreach binary source (if you install it) to confirm no unexpected network endpoints or exfiltration. Run the script against a benign public URL in debug mode to observe browser behavior before using private credentials. If you want to proceed: install Playwright in the skill directory as instructed, separately install/verify xreach, and only point the skill at cookie files from a throwaway/secondary account. If you prefer a simpler approach, prefer a skill that uses only public API endpoints or explicit OAuth tokens rather than file-based cookie migration.

Use the bundled Node script to read X links with minimal token overhead.

Workflow

1. Run scripts/xreader.mjs with the URL.
2. Let the script decide the cheapest path:
   • normal tweet → xreach tweet
   • explicit thread request → xreach thread
   • article / t.co → resolve first, use Playwright only when needed
3. Return the script's structured JSON; summarize from that instead of pasting raw page content.

Positioning

• No official X API required.
• No developer application or paid X API access required.
• Works with login cookies plus low-token routing, which keeps normal tweet reads cheap and uses Playwright only when article rendering is necessary.
• Compared with xreach, this skill is a higher-level reader for agent workflows: it adds article handling, authored-thread filtering, and unified structured output.
• Compared with xcurl, this skill focuses on content extraction from links instead of low-level request control.

Commands

Summary mode (default):

node skills/x-reader/scripts/xreader.mjs "https://x.com/..."

Full mode:

node skills/x-reader/scripts/xreader.mjs --mode full "https://x.com/..."

Thread mode (explicit only, to save tokens):

node skills/x-reader/scripts/xreader.mjs --thread "https://x.com/.../status/..."

Debug mode (headed browser for article extraction):

node skills/x-reader/scripts/xreader.mjs --debug "https://x.com/i/article/..."

Dependencies

Required:

• xreach
• Node.js
• valid X auth cookies

Install article-mode dependency inside the skill directory:

cd skills/x-reader
npm install

Auth

Primary auth path:

~/.config/xreader/session.json

Legacy fallback path:

~/.config/xfetch/session.json

If legacy auth exists, the script migrates it to the new path automatically.

Expected JSON format:

{
  "authToken": "...",
  "ct0": "..."
}

Output contract

Expect structured JSON with fields such as:

• ok
• type (tweet, thread, or article)
• url
• canonicalUrl
• source (xreach or playwright)
• author
• publishedAt
• title
• text / contentText
• contentMarkdown
• summaryText
• fallback / warnings / error

Prefer quoting or summarizing summaryText for low-token responses. Use contentText or contentMarkdown only when the user clearly wants more detail.

Quick verification

Run these after install/auth setup:

node skills/x-reader/scripts/xreader.mjs "https://x.com/yangguangai/status/2033736815405121642?s=46"
node skills/x-reader/scripts/xreader.mjs "https://x.com/yangguangai/status/2033522959407878621?s=46"
node skills/x-reader/scripts/xreader.mjs --thread "https://x.com/google/status/2031558824042058064"

Notes

• Default tweet reads are single-post only for token efficiency.
• Use --thread only when the user clearly wants the authored thread.
• Article extraction is MVP quality: good enough for reading and summarization, but long X articles with many examples/code blocks may still include some template noise.
• If article extraction fails, the script falls back to the original tweet payload and marks the failure in warnings / articleError.
• This skill relies on X login cookies (auth_token + ct0). Cookie-based automation may carry account risk, including additional verification or account restrictions. The risk is usually low for light personal use, but recommend using a secondary account instead of a primary high-value account.

Release checklist

• Confirm SKILL.md includes usage, dependencies, auth path, and limitations.
• Confirm node skills/x-reader/scripts/xreader.mjs --help works.
• Smoke test one tweet, one article, and one thread URL.
• Confirm auth file is not packaged into the skill.
• Package the skill and verify validation passes before publishing.