AIsa Twitter Research Engage Relay

Search X/Twitter profiles, tweets, trends, and OAuth-gated posting through AIsa. Use when: the user needs Twitter research, monitoring, or engagement workflo...

Security Scan

The skill's code, instructions, and required environment variables align with its stated purpose of relaying Twitter/X research, engagement, and OAuth-backed posting through the AIsa relay; nothing appears to be trying to do unrelated work, but it does transmit user-provided files and API credentials to the configured relay so you should trust the relay endpoint and the AISA_API_KEY holder.

Purpose & Capability

Name/description claim Twitter research, engagement, and OAuth posting via AIsa. The package requires only python3 and AISA_API_KEY and includes three clients (read, engagement, OAuth) that call AIsa relay endpoints (api.aisa.one). Those requirements and files are proportional and expected for the described capabilities.

Instruction Scope

SKILL.md instructs the agent to run the provided python scripts, to upload only files the user explicitly attaches, to return authorization links, and to avoid asking for passwords. The scripts can (and will) transmit local workspace files (images/videos) and authorization tokens to the configured relay, and the oauth client exposes an --open-browser option. These behaviors are consistent with posting workflows but are sensitive — uploading local files and sending credentials to an external relay is explicitly part of the workflow.

Install Mechanism

No install spec; skill is delivered as scripts and docs and relies on python3. No downloads or archive extraction occur during install. This is the lowest-risk install profile.

Credentials

Only AISA_API_KEY is required (primaryEnv). Optional TWITTER_RELAY_BASE_URL and TWITTER_RELAY_TIMEOUT are documented. The single API key is appropriate for a relay-backed Twitter client, but that key will be sent to the relay in Authorization headers (and in some POST bodies). If you do not trust the relay (default https://api.aisa.one/apis/v1/twitter or any custom base URL you set), sensitive data and attachments could be exposed.

Persistence & Privilege

The skill is user-invocable, not always-included, and does not request system-wide configuration or modify other skills. It does not request elevated or persistent privileges beyond network access and reading workspace file paths provided to it.

Assessment

This skill appears to do what it says: it runs Python clients that call an AIsa relay (default: https://api.aisa.one/apis/v1/twitter) to search, like/follow, and publish tweets via OAuth. Before installing: 1) Only provide AISA_API_KEY if you trust the relay operator — the key is sent as a Bearer token and (in POSTs) in request bodies. 2) Understand that any local files you attach (images/videos) will be uploaded to the relay and then to Twitter; do not attach sensitive files you do not want transmitted. 3) The oauth client can open a browser for approval; the SKILL.md recommends returning approval links instead of auto-opening — prefer explicit approval flows. 4) If you plan to override TWITTER_RELAY_BASE_URL, ensure the custom endpoint is trustworthy. If you do not trust the relay or the API key holder, do not install or run the posting/upload flows. Otherwise the package is coherent and proportionate to its stated purpose.

Search X/Twitter profiles, tweets, trends, and OAuth-gated posting through AIsa. Use when: the user needs Twitter research, monitoring, or engagement workflows. Supports search, monitoring, and approved posting.

When to use

• The user needs Twitter/X research, monitoring, posting, or engagement workflows.
• The user wants profiles, timelines, trends, lists, communities, or Spaces.
• The user wants approved posting without sharing passwords.

High-Intent Workflows

• Research an account or conversation thread.
• Monitor a keyword, trend, or competitor.
• Authorize and publish a post after explicit approval.

Quick Reference

• python3 scripts/twitter_client.py --help
• python3 scripts/twitter_engagement_client.py --help
• python3 scripts/twitter_oauth_client.py --help

Setup

• AISA_API_KEY is required for AIsa-backed API access.
• Use repo-relative scripts/ paths from the shipped package.
• Prefer explicit CLI auth flags when a script exposes them.
• Optional: set TWITTER_RELAY_BASE_URL to override the default relay https://api.aisa.one/apis/v1/twitter.
• Optional: set TWITTER_RELAY_TIMEOUT to tune relay request timeouts in seconds.
• OAuth requests and any user-approved media uploads use the configured AIsa relay and default to https://api.aisa.one/apis/v1/twitter.
• Provide only AISA_API_KEY; do not use passwords, cookies, or browser credential export.

Example Requests

• Research recent AI agent conversations on X
• Search how users are reacting to a product launch on Twitter
• Authorize and publish a short product update post

Guardrails

• Do not ask for passwords, cookies, or browser credentials.
• Do not claim posting succeeded until the API confirms it.
• Return authorization links instead of relying on auto-open behavior.
• Only upload local files the user explicitly attached, and make it clear those files are sent to the configured AIsa relay first.