← Back to Skills Marketplace
1470
Downloads
1
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install xapi-labs
Description
Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text p...
Usage Guidance
This skill appears to do what it says: it calls the xapi CLI (via npx) to access social, crypto, web, and AI services and expects a single XAPI_API_KEY. Before installing/using: (1) verify you trust https://xapi.to and the npm package that npx will fetch (npx runs remote code); (2) consider installing the CLI locally or pinning a specific package/version rather than using npx each time; (3) be aware the CLI stores the API key in ~/.xapi/config.json — treat that file as sensitive (don’t put high‑privilege secrets there); (4) avoid sending confidential data through this skill because it proxies requests to third-party APIs; (5) if you allow autonomous agent invocation, limit what the agent can send to external services. If you want a stronger assessment, provide the actual npm package name or the package source code so it can be audited.
Capability Analysis
Type: OpenClaw Skill
Name: xapi-labs
Version: 1.0.3
The skill bundle provides a comprehensive interface for the 'xapi' CLI (executed via npx xapi-to) to access Twitter data, crypto prices, web search, and AI services. It includes detailed instructions for the agent on handling API keys, OAuth flows, and service discovery, while explicitly including security warnings to protect the user's API key and avoid logging sensitive payment URLs. No evidence of malicious intent, obfuscation, or unauthorized data exfiltration was found.
Capability Assessment
Purpose & Capability
The name/description match the runtime instructions: SKILL.md tells the agent to run the xapi CLI (via npx) to access Twitter/X, crypto, web/news search, and AI text services. Requesting a single primary credential XAPI_API_KEY is appropriate for a service that proxies external APIs.
Instruction Scope
The SKILL.md stays on topic: it instructs the agent to use npx xapi-to commands, to 'get' action schemas before calling, and to supply JSON inputs. It also documents that the CLI stores the API key at ~/.xapi/config.json or via XAPI_API_KEY. Note that the skill enables calls to third-party API proxies (arbitrary discovered APIs), so agent-invoked requests could send user-provided data to external services — users should be mindful about what data they allow the skill to send.
Install Mechanism
This is an instruction-only skill with no install spec, but it requires npx. That means each invocation will fetch/execute a package (npx xapi-to), which runs remote code from the npm ecosystem. This is expected for CLI wrappers but is higher-risk than invoking a pre-installed binary; consider pinning/verifying the package or installing it locally from a trusted source.
Credentials
Only one primary credential (XAPI_API_KEY) is declared and matches the described purpose. No unrelated environment variables or unrelated credentials are requested. The SKILL.md's mention of storing the key in ~/.xapi/config.json is relevant but means a key will be written to disk (likely in plaintext) unless the CLI manages encryption.
Persistence & Privilege
The skill does not request always: true and uses the platform defaults for invocation. It does direct the CLI to persist the API key in the user's home (~/.xapi/config.json), but it does not request access to other skills' configs or system-wide settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install xapi-labs - After installation, invoke the skill by name or use
/xapi-labs - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.3
- Updated all CLI usage examples and setup instructions to use the new npx entrypoint: npx xapi-to (was npx @xapi-to/xapi)
- Revised command syntax throughout documentation for consistency with the new CLI alias xapi-to
- Updated references and examples for registration, configuration, and workflow steps to reflect the new npx usage
- No feature or functional changes; documentation update only
v1.0.2
xapi-labs v1.0.2 — Major update: new xapi CLI skill replaces previous MD reference.
- Switched from API registration workflow to using the official xapi CLI via npx, supporting real-time data access.
- Concisely documents Twitter/X, crypto, web search, news, and AI text actions with detailed CLI command examples.
- Shows new discovery/search methods for available capabilities and third-party APIs.
- Includes updated setup, authentication, and OAuth Twitter flow for read/write access.
- Improved agent usage guidance: always check required parameters with `get` before calling any action.
v1.0.1
xapi-labs v1.0.1
- Adds comprehensive SKILL.md documentation for the xapi aggregated API platform.
- Explains agent setup, registration flow, security rules, and best practices.
- Details step-by-step self-registration and Twitter account binding process for agents and humans.
- Includes critical security warnings and recommended usage patterns.
- SKILL.md now serves as a persistent agent reference for using xapi's unified MCP interface.
Metadata
Frequently Asked Questions
What is xAPI?
Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text p... It is an AI Agent Skill for Claude Code / OpenClaw, with 1470 downloads so far.
How do I install xAPI?
Run "/install xapi-labs" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is xAPI free?
Yes, xAPI is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does xAPI support?
xAPI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created xAPI?
It is built and maintained by 洛冰河 (@glacier-luo); the current version is v1.0.3.
More Skills