X Interact

This skill appears to do what it says (use Tavily via mcporter to search X/Twitter), but there are important inconsistencies you should consider before installing: - Metadata mismatch: The SKILL.md requires a Tavily API key and the mcporter skill, but the registry metadata does not declare any required env vars or credentials. Treat the Tavily API key as required even though it isn't listed. - API key exposure: The instructions show adding the key into an mcporter URL (https://mcp.tavily.com/mcp/?tavilyApiKey=<YOUR_KEY>). That can cause the key to be stored in config files, appear in process listings, or be logged. Prefer storing keys in a secure credential store or environment variable if possible and check where mcporter persists its config. - Trust the third party: The skill relies entirely on Tavily (mcp.tavily.com). Validate Tavily's reputation, review its privacy and access policies, and ensure the API key's scope is appropriate (rotate/revoke if needed). - Confirm mcporter behavior: Installing/configuring mcporter will persist the MCP endpoint; review mcporter's code/config storage to know where the key will be saved and who/what can read it. - Repo/source verification: The README/skill.json point to a GitHub repo (0x-wzw). The published 'source' and 'homepage' in the registry are unknown — confirm the upstream repository and review its history before trusting the skill. If you decide to proceed: obtain a limited-scope Tavily key, avoid pasting secrets into shared shells or logs, verify mcporter's config storage location, and inspect the referenced GitHub repository and any related skills (mcporter) first.