Yarn - Control and Access Threads.com via the CLI — 技能工具
v0.1.3[自动翻译] Interact with Threads (by Meta) via the yarn-threads-cli. Use when the user wants to read their home feed, likes, saved posts, or a specific thread; l...
0· 409·0 当前·0 累计
by 安全扫描
OpenClaw
安全
medium confidenceThe skill's requirements and instructions are coherent with its stated purpose (a CLI wrapper for Threads), but there are a few small inconsistencies and sensitivity points you should be aware of before installing or using it.
评估建议
This skill appears to be what it says: a CLI client for Threads that needs Threads authentication. Before installing or using it: 1) Verify the npm package and linked GitHub repo (maintainer, recent commits, open issues) because 'npm install -g' runs third-party code on your machine. 2) Avoid pasting full session cookies or tokens into third-party services—prefer pointing the CLI at a local browser profile only if you trust the tool and run it locally. 3) If you must use manual tokens, consider ...详细分析 ▾
ℹ 用途与能力
The SKILL.md and reference document match the name/description: this is a CLI client for Threads (read/post/search). However, the skill metadata declares no required binaries or install steps while the instructions explicitly ask users to run 'npm install -g yarn-threads-cli' and to use a browser profile or session cookies for auth. The absence of a declared required binary (npm or yarn-threads) is a minor metadata inconsistency.
ℹ 指令范围
Instructions are focused on Threads functionality (home, read, post, etc.) and describe three auth methods (Chrome/Firefox profile or manual session tokens). These auth steps require access to browser cookies/session tokens, which are sensitive but necessary for this CLI to work; the SKILL.md asks users to extract cookies from DevTools or point the CLI at a browser profile. The instructions do not direct the agent to read unrelated system files, but they do enable access to local browser profile paths or raw session cookies if the user chooses those options.
ℹ 安装机制
There is no platform-level install spec (this is instruction-only). The README tells users to npm install -g yarn-threads-cli (a public npm package with a linked GitHub repo). Installing a global npm package is a normal way to obtain a CLI but carries the usual risks of running third-party code (verify package source, maintainer, and releases).
✓ 凭证需求
The functionality legitimately requires Threads authentication (sessionid, csrftoken, ds_user_id or browser profile access). The skill metadata does not request unrelated credentials or environment variables. Requesting browser cookies/session tokens is sensitive but proportionate to the stated purpose.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges, nor does it claim to modify other skills or system-wide config. Autonomous invocation is allowed by default (normal for skills) but not combined with other concerning flags.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.32026/2/27
- Clarified authentication instructions, noting users just need to be logged in for Chrome/Firefox profile auth. - Added a new Installation section with npm install instructions. - Referenced the official yarn-threads-cli documentation for detailed authentication setup. - Streamlined the Auth section for improved readability. - No functional changes to commands or features.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install yarn-threads-cli
镜像加速npx clawhub@latest install yarn-threads-cli --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制