X Search (x402)

AI-powered X/Twitter search for real-time trends, breaking news, sentiment analysis, and social media insights. Use when users want to search Twitter/X for topics, hashtags, viral content, or public opinion. Costs $0.05 USDC per request via x402 protocol on Base network.

Do not run this script or call its npx command until you verify a few things: (1) The registry metadata should list the required credential (X402_PRIVATE_KEY) — its omission is an inconsistency. (2) Inspect the npm package @itzannetos/x402-tools-claude (or avoid npx) — npx -y will download and execute code that could exfiltrate your key. Prefer a pinned package version, or vendor the reviewed code into the skill instead of using npx. (3) Avoid storing private keys in plaintext files in your home directory; use environment variables or a secure signer/wallet. (4) If you must test, do so in an isolated environment (throwaway wallet with minimal funds/USDC) and review network calls made by the npm package. If you cannot validate the npm package author and contents, treat this skill as risky.

Type: OpenClaw Skill Name: x-search Version: 1.0.0 The skill is classified as suspicious due to its handling of a sensitive private key and reliance on an external dependency. The `SKILL.md` instructs the AI agent to configure and use an `X402_PRIVATE_KEY` (for payment via x402 protocol) by reading it from environment variables or `~/.x402-config.json`. The `scripts/search.sh` script then reads this private key and exports it for use by `npx @itzannetos/x402-tools-claude`. While the private key is stated to be for payment, handling such a sensitive credential and executing an external, third-party `npx` package introduces significant supply chain and credential management risks, even without explicit evidence of malicious intent within the provided files.