Tweet Search

Use when the user needs to interact with X (Twitter) — searching tweets, looking up users/followers, posting tweets/replies, liking, retweeting, following/un...

What to consider before installing: - Only give XQUIK_API_KEY if you trust the Xquik service and the skill author. This key grants the skill the ability to read/write on your Xquik account (including posting tweets, DMs, follows) so treat it like a password. - SKILL.md contains webhook examples that reference XQUIK_WEBHOOK_SECRET but that secret is not declared as a required env var. If you plan to use webhooks, treat that secret carefully and store it in a secure secret manager rather than in plain config files. - The doc shows examples that instruct adding the API key to local config files (claude, ~/.codex/config.toml, .mcp.json, .vscode). Avoid placing long‑lived keys in widely readable or global config files; prefer ephemeral keys or scoped API keys and rotate them frequently. - The package metadata marks contentTrust: untrusted and the static scan found a prompt‑injection pattern. Inspect SKILL.md yourself for any hidden or override instructions (search the file for phrases like "ignore previous instructions", or instructions that ask the agent to bypass confirmations). If you cannot verify the author (Xquik) independently, be cautious. - Because this is instruction-only, no code is run on your machine by default, which reduces install risk — but the agent will make network calls to xquik.com. Monitor your API usage and billing after enabling the skill; consider creating a restricted API key with only the permissions you need (if Xquik supports that) and set spending limits. If you want to proceed: verify the homepage (https://docs.xquik.com) and confirm the provider identity, use least-privilege credentials, do not store secrets in global files, and review SKILL.md for any prompt‑override text before enabling autonomous use.

Type: OpenClaw Skill Name: tweet-search Version: 1.0.0 The skill bundle is a highly professional and well-documented integration for the Xquik API, providing extensive capabilities for interacting with X (Twitter). It includes robust security guardrails, such as mandatory user confirmation for financial transactions and write actions (e.g., posting tweets or sending DMs), and explicit instructions for the agent to defend against indirect prompt injection from untrusted X content (SKILL.md). While the service handles sensitive X credentials to enable automation, this behavior is transparently documented and strictly aligned with the stated purpose of the tool. No indicators of malicious intent, data exfiltration, or unauthorized execution were found across the 13 files analyzed.