twitterapi-io

Interact with Twitter/X via TwitterAPI.io — search tweets, get user info, post tweets, like, retweet, follow, send DMs, and more. Covers all 67 active endpoi...

This skill appears to implement what it claims (TwitterAPI.io endpoints) but the package metadata fails to declare the sensitive inputs it actually needs. Before installing: 1) confirm the registry/provider will require you to supply TWITTERAPI_IO_KEY (X-API-Key) and that this will be stored/used securely; 2) understand that write operations need login_cookies (session cookie from login) and a residential proxy (credentials), both of which are highly sensitive — do not paste them into public chats or unsecured logs; 3) be cautious calling endpoints that send login_cookies in GET query params (they can end up in logs/urls); 4) verify the skill author/source and prefer official Twitter/X APIs if you need long-running write access; and 5) ask the publisher to update the skill metadata to list required env vars/primary credential and to document how secrets are expected to be provided so you can make an informed decision.

Type: OpenClaw Skill Name: twitterapi-io Version: 3.8.5 The skill bundle provides a comprehensive and well-documented interface for the TwitterAPI.io service, covering 67 endpoints for reading and writing Twitter data. While the skill handles highly sensitive information, including Twitter passwords, 2FA secrets, and session cookies, this behavior is strictly aligned with its stated purpose of facilitating account-based actions via an unofficial API. The documentation (SKILL.md and read-endpoints.md) proactively identifies and warns about security risks, such as the transmission of session cookies in GET parameters for DM history and a known backend bug in profile updates, which suggests transparency rather than malicious intent. No evidence of data exfiltration to unauthorized domains, malicious code execution, or prompt injection was found.