Twitter Query

Query X/Twitter via twitterapi.io read-only APIs by account (user timeline) or by keyword (advanced search). Outputs structured JSON; no LLM, no trend scorin...

This skill appears to do what it claims (fetch tweets via twitterapi.io) and the Python scripts are readable and use only stdlib. Before installing or running it: - Treat TWITTER_API_KEY as a secret. Only provide your real key if you trust the skill and its source; consider using a throwaway/test key first. - Verify the platform metadata: the skill's SKILL.md and scripts require TWITTER_API_KEY, but the registry metadata does not declare it — ask the publisher to update the manifest to list required env vars. - Do not change TWITTER_API_BASE to an unknown host. If you must override it (for testing), run in an isolated environment and monitor network traffic to ensure your API key isn't sent to an unexpected endpoint. - If you have security concerns, inspect the two scripts yourself or run them locally with your network blocked (or a proxy you control) to observe behavior. Ask the publisher to restrict or validate TWITTER_API_BASE in-code if you need stronger guarantees. Because of the metadata inconsistency and the overridable base URL, I rate this as suspicious rather than benign; these are fixable but should be clarified before broad use.

Type: OpenClaw Skill Name: twitter-query Version: 1.0.0 The skill is a legitimate tool for querying Twitter/X data via the twitterapi.io third-party service. The Python scripts (scripts/query_by_user.py and scripts/query_by_keyword.py) use standard libraries to perform read-only API calls, properly handling authentication via the TWITTER_API_KEY environment variable and sanitizing inputs through URL encoding. No indicators of data exfiltration, unauthorized execution, or malicious prompt injection were found in the code or documentation.