Xint Rs

Fast X Intelligence CLI (Rust) — search, analyze, and engage on X/Twitter from the terminal. Use when: (1) user says "x research", "search x for", "search tw...

Security Scan

The skill's code, instructions, and requested credentials are consistent with a CLI for searching/analysing X (Twitter) and optional xAI features; no evidence of unrelated or hidden exfiltration, though some installation and runtime modes require user caution.

Purpose & Capability

Name/description (X intelligence CLI) match the repository contents: many Rust sources implement X API wrappers, search, watch, OAuth, and xAI integrations. Required and optional credentials (X_BEARER_TOKEN, XAI_API_KEY, X_CLIENT_ID, XAI_MANAGEMENT_API_KEY) are appropriate and justified by the documented features (search, Grok analysis, OAuth write actions, collections management).

Instruction Scope

SKILL.md stays on-scope for the declared purpose (search, watch, analyze, export). It explicitly documents writing to data/, storing OAuth tokens, webhook output for watch, and network endpoints (api.x.com, api.x.ai). Watch --webhook and optional package-control-plane settings can send data to external endpoints; those behaviors are declared, but they are the primary places where data leaves the machine and deserve careful review/explicit approval before use.

Install Mechanism

There is no platform-level install specification in the skill registry, but the repo includes an install.sh and README usage that recommend a curl|bash install from GitHub raw. The provided install.sh downloads release assets from GitHub Releases and attempts checksum verification if a checksum asset exists (or REQUIRE_CHECKSUM is set). Downloading from GitHub releases is a standard pattern, but the curl|bash install recommendation and default permissive checksum behavior are risk points — users should inspect the installer or build from source / use a package manager rather than piping to shell.

Credentials

The only required env var is X_BEARER_TOKEN (reasonable for any X/Twitter API client). Optional env vars (XAI_API_KEY, XAI_MANAGEMENT_API_KEY, X_CLIENT_ID) are directly tied to optional features (xAI analysis, collections mgmt, OAuth write actions). There are no unrelated secret env vars requested. Note: optional package-control-plane env vars (XINT_PACKAGE_API_BASE_URL, XINT_PACKAGE_API_KEY) can redirect some functionality to a hosted control plane — those are optional but could cause data to be sent to third-party servers if configured.

Persistence & Privilege

Skill writes data to its own data/ directory (cache, exports, snapshots, OAuth tokens) — expected for follower snapshots and exports. always:false (no forced global presence). The repo can run an optional local MCP server; default is local-only unless explicit flags (like --sse) or envs (package API base) are enabled. Be mindful that enabling hosted control-plane envs or webhooks grants outward network reach for data; SKILL.md requests explicit user approval for network-facing modes, but the platform-level registry flags may still allow autonomous invocation, so user consent/inspection is recommended before enabling those modes.

Assessment

This skill appears coherent for its stated purpose, but take these precautions before installing or enabling network modes: - Inspect the installer: README suggests curl -fsSL https://raw.githubusercontent.com/... | bash. Prefer building from source (cargo build) or using Homebrew/packages, or at minimum download and inspect install.sh before running it. Consider setting REQUIRE_CHECKSUM=1 and verify checksums if you install prebuilt binaries. - Protect credentials: X_BEARER_TOKEN is required and is powerful (read access to tweets). Store it only in a secure environment (.env or env variables), and never paste it into public logs. xAI keys and OAuth client IDs are optional but also sensitive. - Watch/webhook and package-control-plane: watch --webhook will POST tweet data to any URL you provide; only use webhooks you control. Do not set XINT_PACKAGE_API_BASE_URL / XINT_PACKAGE_API_KEY to untrusted services — that can cause exported data or MCP tool results to be relayed elsewhere. - File writes: the tool stores cache, exports, snapshots, and OAuth tokens in data/. Review data/ before sharing and secure filesystem permissions (SKILL.md indicates tokens use chmod 600). - Autonomous agent use: SKILL.md asks for explicit approval before network-facing modes; if you intend agents to use this skill autonomously, restrict those modes or supervise execution. If in doubt, run the binary manually first to verify behavior. If you want stronger assurance, build the binary from the included source (cargo build --release) and inspect the built binary or run it in an isolated environment (container/VM) before granting secrets or enabling external endpoints.

xint — X Intelligence CLI (Rust)

Fast, zero-dependency binary for X/Twitter search, analysis, and engagement from the terminal. All output goes to stdout (pipe-friendly).

Security Considerations

This skill requires sensitive credentials. Follow these guidelines:

Credentials

• X_BEARER_TOKEN: Required for X API. Treat as a secret - only set in environment or .env file
• XAI_API_KEY: Optional, needed for AI analysis. Also a secret
• X_CLIENT_ID: Optional, needed for OAuth. Less sensitive but don't expose publicly
• XAI_MANAGEMENT_API_KEY: Optional, for collections management

File Writes

• This skill writes to its own data/ directory: cache, exports, snapshots, OAuth tokens
• OAuth tokens stored with restrictive permissions (chmod 600)
• Review exported data before sharing - may contain sensitive search queries

Webhooks

• The watch command supports --webhook to send data to external URLs
• Only use webhooks you control (your own servers, Slack/Discord you own)
• Don't pass sensitive URLs as webhook targets

Agent Execution Boundaries

• This file documents commands and safety limits only
• Require explicit user approval before install/clone actions
• Use only documented commands and flags
• Require explicit user approval before network-facing modes (mcp --sse, watch --webhook)

Installation

• For required tools: prefer OS package managers over curl | bash when possible
• Verify any installer scripts before running

MCP Server (Optional)

• xint mcp starts a local MCP server exposing xint commands as tools
• Default mode is stdio/local integration; no inbound web server unless --sse is explicitly enabled
• Respect --policy read_only|engagement|moderation and budget guardrails

Setup

Requires env vars (in .env or exported):

• X_BEARER_TOKEN — for search, profile, tweet, thread, trends, watch, report
• X_CLIENT_ID — for OAuth commands (bookmarks, likes, following, diff)
• XAI_API_KEY — for AI analysis (analyze, report, x-search, collections upload/search)
• XAI_MANAGEMENT_API_KEY — for collections management (list, create, ensure, add-document)

OAuth setup (one-time): xint auth setup

Commands

Search & Discovery

xint search "AI agents" --limit 10            # Search recent tweets
xint search "AI agents" --quick               # Fast mode (1 page, 10 max, 1hr cache)
xint search "AI agents" --quality             # Min 10 likes filter
xint search "AI agents" --since 1d --sort likes
xint search "from:elonmusk" --limit 5
xint search "AI agents" --json                # JSON output
xint search "AI agents" --jsonl               # One JSON per line
xint search "AI agents" --csv                 # CSV output
xint search "AI agents" --sentiment           # AI sentiment analysis (needs XAI_API_KEY)
xint search "AI agents" --save                # Save to data/exports/

Monitoring

xint watch "AI agents" -i 5m                  # Poll every 5 minutes
xint watch "@elonmusk" -i 30s                 # Watch user (auto-expands to from:)
xint watch "bitcoin" --webhook https://example.com/webhook  # POST new tweets to webhook
xint watch "topic" --jsonl                    # Machine-readable output

Profiles & Tweets

xint profile elonmusk                         # User profile + recent tweets
xint profile elonmusk --json                  # JSON output (includes connection_status, subscription_type)
xint tweet 1234567890                         # Fetch single tweet
xint thread 1234567890                        # Fetch conversation thread

Reposts (who reposted a tweet)

xint reposts <tweet_id>                       # List users who reposted
xint reposts <tweet_id> --limit 50            # Limit results
xint reposts <tweet_id> --json                # JSON output

User Search

xint users "AI researcher"                    # Find users by keyword
xint users "solana dev" --limit 10 --json     # JSON output with limit

Article Fetching (requires XAI_API_KEY)

Fetch and extract full article content from any URL using xAI's web_search tool. Also supports extracting linked articles from X tweets.

# Fetch article content
xint article "https://example.com"

# Fetch + analyze with AI
xint article "https://example.com" --ai "Summarize key takeaways"

# Auto-extract article from X tweet URL and analyze
xint article "https://x.com/user/status/123456789" --ai "What are the main points?"

# Full content without truncation
xint article "https://example.com" --full

# JSON output
xint article "https://example.com" --json

Trends

xint trends                                   # Worldwide trending
xint trends us                              # US trends
xint trends --json                          # JSON output
xint trends --locations                     # List supported locations

AI Analysis (requires XAI_API_KEY)

xint analyze "What's the sentiment around AI?"       # Default model: grok-4-1-fast
xint analyze --tweets saved.json              # Analyze tweets from file
cat tweets.json | xint analyze --pipe         # Analyze from stdin
xint analyze "question" --model grok-4        # Use specific model

Available models: grok-4, grok-4-1-fast (default), grok-3, grok-3-mini, grok-2

Intelligence Reports

xint report "AI agents"                       # Full report with AI summary
xint report "AI agents" -a @user1,@user2      # Track specific accounts
xint report "AI agents" -s                    # Include sentiment analysis
xint report "AI agents" --save                # Save to data/exports/

Follower Tracking (requires OAuth)

xint diff @username                           # Snapshot followers, diff vs previous
xint diff @username --following               # Track following instead
xint diff @username --history                 # Show snapshot history

Bookmarks & Engagement (requires OAuth)

xint bookmarks                                # List bookmarks
xint bookmarks --since 1d                     # Recent bookmarks
xint bookmark 1234567890                      # Save tweet
xint unbookmark 1234567890                    # Remove bookmark
xint likes                                    # List liked tweets
xint like 1234567890                          # Like a tweet
xint unlike 1234567890                        # Unlike a tweet
xint following                                # List accounts you follow

Cost Tracking

xint costs                                    # Today's API costs
xint costs week                               # Last 7 days
xint costs month                              # Last 30 days
xint costs budget 2.00                        # Set $2/day budget

Watchlist

xint watchlist                                # List watched accounts
xint watchlist add @username "competitor"     # Add with note
xint watchlist remove @username               # Remove
xint watchlist check @username                # Check if watched

xAI X Search (no cookies/GraphQL)

Search X via xAI's hosted x_search tool (Responses API). No bearer token or cookies needed — only XAI_API_KEY.

# Create a queries file
echo '["AI agents", "solana"]' > queries.json

# Run search scan → markdown report + JSON payload
xint x-search --queries-file queries.json --out-md report.md --out-json raw.json

# Date range filter
xint x-search --queries-file queries.json --from-date 2026-02-01 --to-date 2026-02-15

# Domain filtering
xint x-search --queries-file queries.json --allow-domains arxiv.org,github.com
xint x-search --queries-file queries.json --exclude-domains spam.com

# Image understanding in search results
xint x-search --queries-file queries.json --vision

# Custom model
xint x-search --queries-file queries.json --model grok-4-1-fast

xAI Collections Knowledge Base

Upload documents, manage collections, and semantic-search via xAI Files + Collections APIs.

# List existing collections
xint collections list

# Create or find a collection
xint collections ensure --name "research-kb"

# Upload a file to xAI
xint collections upload --path ./report.md

# Semantic search across documents
xint collections search --query "AI agent frameworks"

# Sync a directory to a collection (upload + attach)
xint collections sync-dir --collection-name "kb" --dir ./docs --glob "*.md" --limit 50

Utilities

xint auth setup                               # OAuth setup (interactive)
xint auth setup --manual                      # Manual paste mode
xint auth status                              # Show auth info
xint auth refresh                             # Force token refresh
xint cache clear                              # Clear cached data

Output Formats

Most commands support --json for raw JSON. Search also supports:

• --jsonl — one JSON object per line (great for piping)
• --csv — spreadsheet-compatible
• --markdown — formatted for reports

Piping

xint search "topic" --jsonl | jq '.username'
xint search "topic" --json | xint analyze --pipe "summarize these"
xint search "topic" --csv > export.csv

Cost Awareness

X API costs ~$0.005/tweet read. Budget system prevents runaway costs:

• Default: $1.00/day limit
• Set custom: xint costs budget <amount>
• Watch command auto-stops at budget limit

xAI Model Pricing (per 1M tokens)

• grok-4-1-fast: $0.20 input / $0.50 output (default — best value)
• grok-4: $3.00 input / $15.00 output
• grok-3: $3.00 input / $15.00 output
• grok-3-mini: $0.10 input / $0.40 output
• grok-2: $2.00 input / $10.00 output