X to Kindle — 技能工具
v1.0.0Send X/Twitter posts to Kindle for distraction-free reading. Use when user shares an X/Twitter link and wants to read it on Kindle, or asks to send a tweet/thread to their Kindle device.
1· 1,761·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's purpose (send X/Twitter posts to Kindle) is plausible, but the runtime instructions ask for user credentials and recommend storing them in a markdown file while the skill metadata declares no required credentials — that's an inconsistency and a privacy risk.
评估建议
This skill could do what it promises, but it asks you to provide sensitive credentials (Gmail app password) and recommends storing them in a plaintext TOOLS.md file — while the skill metadata does not declare any required credentials. Before installing or using it: (1) prefer using a dedicated Gmail App Password or an SMTP relay account created just for this purpose, not your primary account; (2) do NOT store credentials in an unencrypted markdown file — use a secure secrets manager or the platf...详细分析 ▾
ℹ 用途与能力
The described functionality (fetch a tweet, format it, email it to a Kindle address) is coherent for an "X to Kindle" skill. Using an HTTP API to fetch tweet data and SMTP to deliver to the Kindle is expected. However the choice of a third-party proxy API (api.fxtwitter.com) introduces an external dependency that will see the fetched content; that should be explicit in the metadata.
⚠ 指令范围
SKILL.md explicitly instructs fetching tweet content from api.fxtwitter.com and sending mail via SMTP, and tells users to store Gmail app passwords and the Kindle address in TOOLS.md. It therefore requires the agent (or user) to handle secrets and to contact a third-party service — actions not reflected in the declared requirements. Instructing plaintext storage of credentials in a markdown file is insecure and broadens data exposure.
✓ 安装机制
No install spec and no code files — instruction-only skill — so there is no installer or downloaded code to evaluate. This minimizes on-disk execution risk.
⚠ 凭证需求
The metadata lists no required env vars or credentials, but the runtime instructions clearly require SMTP credentials (Gmail app password) and the user's Kindle email. That mismatch is a red flag: secrets are necessary for operation but weren't declared. Additionally, instructions recommend storing secrets in TOOLS.md (plaintext), which is disproportionate and insecure.
✓ 持久化与权限
The skill does not request always: true and has no install-time persistence or modifications to other skills. Autonomous invocation is allowed (platform default) but that alone is not an additional red flag here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/1/27
- Want to read post from X on kindle? just share the link to telegram and it will email the post to your kindle. Enjoy!
● 无害
安装命令 点击复制
官方npx clawhub@latest install x-kindle
镜像加速npx clawhub@latest install x-kindle --registry https://cn.clawhub-mirror.com
技能文档
Convert X/Twitter posts into Kindle-readable documents via email.
Requirements
- Gmail account with App Password (or other SMTP setup)
- Kindle email address (found in Amazon account settings)
Workflow
When user shares an X link:
- Extract content via fxtwitter API:
https://api.fxtwitter.com/status/
twitter.com//status/ or x.com//status/- Format as HTML email:
@{author_handle}
{tweet_text}
{timestamp}
- Send via SMTP to user's Kindle address with subject line as tweet preview.
Configuration
Store in TOOLS.md:
## Kindle
- Address: user@kindle.com
Email (Gmail SMTP)
- From: your@gmail.com
- App Password: xxxx xxxx xxxx xxxx
- Host: smtp.gmail.com
- Port: 587
Example
User sends: https://x.com/elonmusk/status/1234567890
- Fetch
https://api.fxtwitter.com/status/1234567890 - Extract author, text, timestamp
- Send HTML email to Kindle address
- Confirm: "Sent to Kindle 📚"
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制