X/Twitter Prospecting

Find and engage potential leads on X (Twitter) by searching for keywords and buying-intent posts via Brave Search.

Security Scan

The skill's requested permission (BRAVE_API_KEY), instructions, and included code are consistent with its stated purpose of finding and scoring X (Twitter) leads via Brave Search; nothing in the manifest or visible code suggests unexplained or disproportionate access.

Purpose & Capability

The skill claims to search X via Brave Search and only requests BRAVE_API_KEY. package.json/openclaw metadata and the SKILL.md both declare Brave Search usage; the code references process.env.BRAVE_API_KEY. The requested credential is proportional and relevant to the stated purpose.

Instruction Scope

SKILL.md instructs the agent to call the Brave Search API (site:x.com), parse results to extract handles/tweet text, score prospects, and generate DM/thread content. It does not instruct reading unrelated system files or other environment variables. It generates outreach templates but does not itself claim to send DMs via X (no X credentials requested).

Install Mechanism

No install spec is provided (instruction-only plus bundled JS file). There are no downloads from remote URLs or package installs defined by the skill; the included code will run locally under Node.js. This is low risk from an install mechanism perspective.

Credentials

Only BRAVE_API_KEY is required and is necessary for making Brave Search API queries. No unrelated secrets or config paths are requested. The skill reads process.env.BRAVE_API_KEY in the code, matching the declared requirement.

Persistence & Privilege

always is false (default) and the skill does not request persistent or cross-skill configuration changes. Autonomous invocation is allowed by platform default but the skill does not request elevated persistent privileges.

Assessment

This skill appears internally consistent: it only needs a Brave Search API key to query site:x.com and generate outreach content. Before installing, double-check the full x-prospecting.js (the bundled code) for any unexpected outbound endpoints or telemetry if you want extra assurance. Store your BRAVE_API_KEY securely and grant only to trusted agents; if you plan to run the skill in autonomous mode, be aware it may perform many Brave queries (watch quotas/rate limits). Also verify you remain compliant with X/Twitter rules and anti-spam laws when using generated outreach templates.

X (Twitter) Prospecting Skill

Find potential leads on X by searching for keyword mentions and buying-intent posts. Uses the Brave Search API to query site:x.com — no X API credentials required.

Available Tools

Run with Node.js: node {baseDir}/x-prospecting.js <command> [args]

• search - Search X posts by keyword via Brave
• score - Score a prospect based on their tweet and bio signals
• thread - Generate a lead-magnet thread outline
• dm-sequence - Generate a DM outreach sequence for a prospect

Usage

node {baseDir}/x-prospecting.js search "looking for AI tools"
node {baseDir}/x-prospecting.js score --handle "@username" --bio "founder at SaaS" --tweet "frustrated with my current tool"
node {baseDir}/x-prospecting.js dm-sequence --handle "@username" --name "Jane"

How Brave Search Works for X

curl -s -H "Accept: application/json" \
     -H "X-Subscription-Token: $BRAVE_API_KEY" \
     "https://api.search.brave.com/res/v1/web/search?q=site:x.com+%22looking+for+AI+tools%22&count=10"

Substitute the query with your target keywords. Parse results to extract handles and tweet text, then run through lead scoring.

Environment Variables

• BRAVE_API_KEY - Brave Search API key (free tier: 2,000 queries/month)