Xint Rs

Fast X Intelligence CLI (Rust) — search, analyze, and engage on X/Twitter from the terminal. Use when: (1) user says "x research", "search x for", "search tw...

This skill appears coherent for its stated purpose, but take these precautions before installing or enabling network modes: - Inspect the installer: README suggests curl -fsSL https://raw.githubusercontent.com/... | bash. Prefer building from source (cargo build) or using Homebrew/packages, or at minimum download and inspect install.sh before running it. Consider setting REQUIRE_CHECKSUM=1 and verify checksums if you install prebuilt binaries. - Protect credentials: X_BEARER_TOKEN is required and is powerful (read access to tweets). Store it only in a secure environment (.env or env variables), and never paste it into public logs. xAI keys and OAuth client IDs are optional but also sensitive. - Watch/webhook and package-control-plane: watch --webhook will POST tweet data to any URL you provide; only use webhooks you control. Do not set XINT_PACKAGE_API_BASE_URL / XINT_PACKAGE_API_KEY to untrusted services — that can cause exported data or MCP tool results to be relayed elsewhere. - File writes: the tool stores cache, exports, snapshots, and OAuth tokens in data/. Review data/ before sharing and secure filesystem permissions (SKILL.md indicates tokens use chmod 600). - Autonomous agent use: SKILL.md asks for explicit approval before network-facing modes; if you intend agents to use this skill autonomously, restrict those modes or supervise execution. If in doubt, run the binary manually first to verify behavior. If you want stronger assurance, build the binary from the included source (cargo build --release) and inspect the built binary or run it in an isolated environment (container/VM) before granting secrets or enabling external endpoints.

Type: OpenClaw Skill Name: xint-rs Version: 2026.2.26 The xint-rs skill bundle is a legitimate and well-architected Rust-based CLI tool for X (Twitter) intelligence and xAI integration. It includes robust security features such as a daily budget guard to prevent runaway API costs (src/costs.rs), OAuth 2.0 PKCE for secure user-context operations (src/auth/oauth.rs), and a webhook validation utility (src/webhook.rs) that enforces HTTPS and supports host allowlisting. The SKILL.md file provides clear instructions and safety boundaries for the AI agent, including explicit requirements for user approval before performing network-facing or installation tasks. No evidence of malicious behavior, data exfiltration, or prompt injection was found.