by 安全扫描
OpenClaw
可疑
high confidenceThe skill’s stated functionality (control an X/Twitter account) lines up with its instructions, but it requires you to download and run an arbitrary executable and export your browser cookies—both risky practices that are not safety-checked or justified in the SKILL.md.
评估建议
This skill asks you to download and run an unsigned third-party executable and to export your X/Twitter session cookies—doing so hands that binary the ability to act as your account. Before installing: (1) prefer official OAuth/API-key based integrations over exporting cookies; (2) if you must use this, review the executable’s source code or use builds from a verified maintainer and verify checksums/signatures; (3) run the binary in an isolated environment (VM/container) and not on your primary ...详细分析 ▾
ℹ 用途与能力
Name/description match the instructions: the skill uses a local service that drives X using browser session cookies. Asking for a local helper that uses cookies to control an account is coherent with the stated purpose.
⚠ 指令范围
The runtime instructions tell the user to export X cookies from Chrome into cookies.json and run a third‑party executable that listens on localhost. That requires handing full session credentials to a binary and does not include guidance for protecting or verifying those credentials. The SKILL.md also instructs running an arbitrary local service without integrity checks.
⚠ 安装机制
No formal install spec is provided, but the guide instructs downloading an executable from a GitHub Releases page and running it. There are no checksums, signatures, or instructions to verify the binary or inspect its source—this is a high-risk operation (running an opaque binary with account cookies).
ℹ 凭证需求
No env vars or config paths are declared, which is consistent with an approach that uses browser cookies. However, the requirement to export cookies.json is effectively requesting highly sensitive session credentials (equivalent to full access tokens). This is proportionate to the task technically, but the SKILL.md does not provide any safeguards or alternative (OAuth/API-key) options.
✓ 持久化与权限
The skill does not request always: true or system-wide config changes; it is user-invocable and does not declare persistent privileges over other skills or agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.2.22026/2/26
Switch skill description to English
● 可疑
安装命令 点击复制
官方npx clawhub@latest install openclaw-x
镜像加速npx clawhub@latest install openclaw-x --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制