安全扫描
OpenClaw
可疑
medium confidence该技能声称为 X/Twitter CLI,但其元数据和指令不一致:未声明浏览器 cookie 和 SWEETISTICS_API_KEY,同时安装第三方 Homebrew 公式 — 请谨慎操作。
评估建议
该技能看似为 'bird' CLI 的封装,但存在多个红旗。安装前:(1)验证 GitHub 上的 brew 公式源(steipete/tap)和公式内容;(2)确认 'bird' 二进制文件如何处理浏览器 cookie 并从哪里读取 — 只有信任时才授权;(3)如果使用该引擎,准备提供 SWEETISTICS_API_KEY,不要提供秘密 unless 信任服务;(4)警惕技能名称和未知主页的不匹配 — 可能指示包装不当或误导性列表。如果不确定,在沙盒环境中运行 CLI 或选择明确声明 env/config 要求和知名源的技能。...详细分析 ▾
⚠ 用途与能力
The skill description and SKILL.md describe an X/Twitter CLI (bird). However the skill name ('cleans and optimize Xbio cleaner') does not match that purpose. The declared requirement (binary 'bird' and a brew formula for steipete/tap/bird) is coherent for a Twitter CLI, but the mismatched skill name and unknown homepage (bird.fast) are odd and worth verifying.
⚠ 指令范围
Runtime instructions tell the agent to use browser cookies (Firefox/Chrome) and optionally the Sweetistics API. Accessing browser cookies implies reading local browser stores or calling a helper binary that does so — yet no config paths or permissions are declared. The SKILL.md also references an env var (SWEETISTICS_API_KEY) that the skill metadata does not list. That mismatch means the skill may access credentials or local data without them being declared.
ℹ 安装机制
Install is via a Homebrew formula: steipete/tap/bird. Using brew is common, but this is a third‑party tap (not necessarily homebrew/core). Third‑party taps can run arbitrary install scripts; inspect the formula repository before installing.
⚠ 凭证需求
SKILL.md documents SWEETISTICS_API_KEY as an auth source and browser cookies as a default auth method, but requires.env is empty and no config paths are declared. That omission is an inconsistency: the skill may rely on or read secrets/config that aren't declared up front.
✓ 持久化与权限
always:false (no forced global presence) and no install-time actions beyond the brew formula are declared. The skill does not claim to modify other skills or system-wide settings.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/7
bird 技能的初始发布,一个用于与 X/Twitter 交互的 CLI 工具。- 通过命令行读取、搜索推文/回复。- 支持通过浏览器 cookie 或 Sweetistics API 进行身份验证。- 快速命令用于读取用户信息、线程和搜索结果。- 具有用户确认的灵活发布选项。- 通过 Homebrew 轻松安装。
● 可疑
安装命令 点击复制
官方npx clawhub@latest install xbio
镜像加速npx clawhub@latest install xbio --registry https://cn.clawhub-mirror.com
技能文档
bird
使用bird 读取/搜索 X 和发布推文/回复。
快速开始
bird whoamibird readbird threadbird search "query" -n 5
bird tweet "text"bird reply"text"
- 浏览器 cookie(默认:Firefox/Chrome)
- Sweetistics API:设置
SWEETISTICS_API_KEY或使用--engine sweetistics - 检查来源:
bird check
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制