by 安全扫描
OpenClaw
可疑
high confidenceThe skill's instructions ask you to run an unpinned npm package and supply sensitive browser cookie values and an optional wallet private key, but the registry metadata doesn't declare those requirements — these inconsistencies and sensitive requests are suspicious.
评估建议
Do not paste your Twitter session cookies or your wallet private key into a third-party skill unless you fully trust and can verify the code and publisher. The SKILL.md asks you to run an unpinned npm package via npx and to store sensitive tokens in your settings; that package will execute arbitrary code locally. Before installing: (1) verify the package source and repository (read its code, release tags, and who publishes it), (2) prefer official OAuth/API keys rather than raw session cookies, ...详细分析 ▾
⚠ 用途与能力
The skill claims to provide Twitter/X actions (read/post/engage), which is plausible, but the SKILL.md requires raw x.com cookie values (auth_token, ct0) and an optional wallet private key. The registry metadata lists no required env vars or credentials, which conflicts with the SKILL.md. Asking for browser cookies and a private key is not explained by the high-level description and is disproportionate.
⚠ 指令范围
Runtime instructions tell the user to run 'claude mcp add xbird -- npx @checkra1n/xbird' (fetch-and-run via npx) and to store cookies or keys in ~/.claude/settings.json or the shell. That directs execution of remote code and explicit manual extraction/pasting of session cookies and a private key — sensitive actions that go beyond typical API OAuth flows and could enable account takeover or fund access.
⚠ 安装机制
Although the registry lists no install spec, the SKILL.md instructs using npx to fetch and run @checkra1n/xbird. npx will download and execute unpinned code from the npm registry (moderate-to-high risk). The package name ("@checkra1n") and lack of a pinned, audited source or repository URL increase risk. This is an install-time action that can run arbitrary code locally.
⚠ 凭证需求
The skill asks for XBIRD_AUTH_TOKEN and XBIRD_CT0 (x.com cookies) and optionally XBIRD_PRIVATE_KEY (wallet). For Twitter integration, official OAuth tokens are expected; requiring session cookies and a wallet private key is sensitive and not proportionate to the described functionality. The metadata declared no required env vars, which is inconsistent with the instructions.
⚠ 持久化与权限
The instructions add an MCP server to the agent ('claude mcp add ...'), which modifies the agent's configuration and will cause the agent to rely on an external component provided by the npx package. While 'always' is false, this still creates persistent capability and a locally-running component that may act autonomously and make micropayments — combined with the private key request, this is notable.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.12026/2/13
Initial publish: 34 Twitter/X MCP tools with x402 micropayments on Base
● 可疑
安装命令 点击复制
官方npx clawhub@latest install xbird
镜像加速npx clawhub@latest install xbird --registry https://cn.clawhub-mirror.com
技能文档
34 MCP tools for Twitter/X with x402 micropayments. Runs locally from residential IP.
Setup
Add xbird MCP server to Claude Code:
claude mcp add xbird -- npx @checkra1n/xbird
Required environment variables (set in ~/.claude/settings.json or shell):
XBIRD_AUTH_TOKEN— from x.com cookies (DevTools → Application → Cookies →auth_token)XBIRD_CT0— from x.com cookies (DevTools → Application → Cookies →ct0)XBIRD_PRIVATE_KEY— wallet private key for x402 payments (optional, needed for paid tier)
Tools Reference
Read — $0.001/call
| Tool | Description |
|---|---|
get_tweet | Get tweet by ID |
get_thread | Get full thread/conversation chain |
get_replies | Get replies to a tweet (supports count, cursor) |
get_user | Get user profile by handle |
get_user_about | Get detailed user info (bio, stats, links) |
get_current_user | Get authenticated user's profile |
get_home_timeline | Get home feed (supports count, cursor) |
get_news | Get trending topics (tabs: trending, forYou, news, sports, entertainment) |
get_lists | Get owned Twitter lists |
get_list_timeline | Get tweets from a list by list ID |
Search — $0.005/call
| Tool | Description |
|---|---|
search_tweets | Search tweets. Supports operators: from:user, to:user, since:2024-01-01, filter:media, -filter:retweets |
get_mentions | Get mentions for a handle |
Bulk — $0.01/call
| Tool | Description |
|---|---|
get_user_tweets | Get user's tweets. Requires numeric userId — get it from get_user first |
get_followers | Get user's followers. Requires numeric userId |
get_following | Get who user follows. Requires numeric userId |
get_likes | Get user's liked tweets. Requires numeric userId |
get_bookmarks | Get bookmarked tweets |
get_list_memberships | Get lists user is a member of |
Write — $0.01/call
| Tool | Description |
|---|---|
post_tweet | Post a tweet. Pass mediaIds array to attach media |
reply_to_tweet | Reply to a tweet by replyToId |
post_thread | Post a thread — array of strings, minimum 2 tweets |
like_tweet / unlike_tweet | Like or unlike by tweet ID |
retweet / unretweet | Retweet or undo by tweet ID |
bookmark_tweet / unbookmark_tweet | Bookmark or remove by tweet ID |
follow_user / unfollow_user | Follow or unfollow by handle |
Profile — $0.01/call
| Tool | Description |
|---|---|
update_profile | Update bio/description text |
update_profile_image | Update avatar — absolute file path to image |
update_profile_banner | Update banner — absolute file path to image |
remove_profile_banner | Remove banner image |
Media — $0.05/call
| Tool | Description |
|---|---|
upload_media | Upload image/video, returns mediaId. Pass it to post_tweet or reply_to_tweet via mediaIds |
Common Workflows
Post a tweet with an image
upload_mediawith file path → getmediaIdpost_tweetwith text andmediaIds: [""]
Get someone's recent tweets
get_userwith handle → get numericuserIdget_user_tweetswithuserId
Update profile with new avatar and bio
update_profile_imagewith file pathupdate_profilewith new description text
Search and engage
search_tweetswith query (e.g."AI agents" since:2024-01-01 -filter:retweets)like_tweetorretweetinteresting results
Important Notes
- Handles: work with or without
@prefix - userId vs handle: Bulk tools require numeric
userId. Always callget_userfirst to resolve handle → userId - Pagination: most list tools accept
cursorfrom previous response for next page - Media flow: always upload first, then attach
mediaIdto tweet - Rate limits: if a tool returns an error about rate limiting, wait 1-2 minutes before retrying
- x402 payments: all calls are metered via micropayments on Base (USDC). Free tier available without wallet key
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制