Twitter Command Center Search Post Interact

Search X/Twitter profiles, tweets, trends, and OAuth-gated posting through AIsa. Use when: the user needs Twitter research, monitoring, or engagement workflo...

Security Scan

The skill's code, instructions, and required credential (AISA_API_KEY) are consistent with its stated purpose of read/search/engagement and OAuth-backed posting via the AIsa relay service.

Purpose & Capability

The name/description (Twitter/X search, monitoring, engagement, and OAuth posting) matches the shipped scripts and references. The scripts call aisa-backed relay endpoints (api.aisa.one) and implement read/search, engagement (like/follow), and OAuth-backed posting flows — which is coherent with the stated purpose.

Instruction Scope

SKILL.md limits inputs (no passwords, return auth links, use workspace file paths) and points to the bundled scripts. The scripts will read local workspace files when attaching media and may optionally open a browser when authorize is called with --open-browser. This is acceptable for the posting workflow but is a small scope mismatch with the guardrail that prefers returning the link instead of auto-opening the browser (scripts expose both behaviors via flags).

Install Mechanism

This is an instruction-only skill with bundled Python scripts and no install spec. It only requires python3 on PATH and does not download or execute external archives during install — low install risk.

Credentials

The only declared required env var is AISA_API_KEY, which is the primary credential used for requests to the AIsa relay — proportional to the described purpose. The code also reads optional envs (TWITTER_RELAY_BASE_URL and TWITTER_RELAY_TIMEOUT) but they default to safe values; these are not declared in requires.env in SKILL.md and are only optional configuration overrides.

Persistence & Privilege

always is false and the skill does not request system-wide persistence or modify other skills. It runs as a user-invoked skill and uses only its own scripts and local workspace files.

Assessment

This skill talks to the AIsa relay (https://api.aisa.one) and requires your AISA_API_KEY; using it will send that key in Authorization headers and (for POSTs) include it in request bodies to the relay. The skill will upload any workspace media files you attach to the relay for posting. Before installing, confirm you trust AIsa/api.aisa.one as the relay for posting on your behalf. The skill will not ask for your Twitter password or cookies; OAuth is performed via the relay. If you need to change the relay endpoint, the code accepts TWITTER_RELAY_BASE_URL as an override. Finally, be aware the scripts can open a browser when authorize is run with the --open-browser flag; prefer the default flow that returns an authorization link so you control the approval step.

Search X/Twitter profiles, tweets, trends, and OAuth-gated posting through AIsa. Use when: the user needs Twitter research, monitoring, or engagement workflows. Supports search, monitoring, and approved posting.

When to use

• The user needs Twitter/X research, monitoring, posting, or engagement workflows.
• The user wants profiles, timelines, trends, lists, communities, or Spaces.
• The user wants approved posting without sharing passwords.

High-Intent Workflows

• Research an account or conversation thread.
• Monitor a keyword, trend, or competitor.
• Authorize and publish a post after explicit approval.

Quick Reference

• python3 scripts/twitter_client.py --help
• python3 scripts/twitter_engagement_client.py --help
• python3 scripts/twitter_oauth_client.py --help

Setup

• AISA_API_KEY is required for AIsa-backed API access.
• Use repo-relative scripts/ paths from the shipped package.
• Prefer explicit CLI auth flags when a script exposes them.

Example Requests

• Research recent AI agent conversations on X
• Search how users are reacting to a product launch on Twitter
• Authorize and publish a short product update post

Guardrails

• Do not ask for passwords, cookies, or browser credentials.
• Do not claim posting succeeded until the API confirms it.
• Return authorization links instead of relying on auto-open behavior.