xAPI

Use xapi CLI to access real-time external data — Twitter/X profiles, tweets, and timelines, crypto token prices and metadata, web search, news, and AI text p...

This skill appears to be a thin wrapper around the external xapi CLI and legitimately needs an XAPI_API_KEY and npx. Before installing or using it: (1) verify the xapi project and operator (visit https://xapi.to, inspect their docs and privacy policy); (2) prefer exporting your API key as an environment variable (XAPI_API_KEY) rather than using any automatic "register" flow that saves credentials to ~/.xapi/config.json — if you must use the file, inspect its contents and tighten permissions (chmod 600) and understand where the file is written; (3) be aware that the tool can discover and call arbitrary third‑party APIs (it can proxy requests), so avoid sending sensitive secrets or private data through it and consider a scoped or throwaway API key; (4) if you need higher assurance, ask the skill author for source code or a published package link (npm/github) and for a declared config path in the metadata (to match the README); and (5) monitor network use and audit the ~/.xapi directory after use. These clarifications would raise my confidence and could change the verdict to benign if answered satisfactorily.

Type: OpenClaw Skill Name: xapi123123 Version: 1.0.2 The xapi skill provides an interface for an AI agent to interact with external data services (Twitter, Crypto, Search, AI) via the `npx xapi-to` CLI. It includes comprehensive instructions for the agent, handles API key configuration in `~/.xapi/config.json`, and features explicit security warnings in `SKILL.md` to prevent the agent from leaking sensitive credentials to unauthorized domains. The functionality is consistent with its stated purpose as an API gateway, and no evidence of malicious intent or obfuscation was found.