X Twitter Command Center (Search + Post)

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent for searching and posting to X/Twitter, but it uses an AIsa API key, Twitter OAuth, and can publish public posts or upload selected media.

Before installing, make sure you trust the AIsa relay/API provider, use the intended Twitter/X account, and review any post text or attached media before letting the agent publish.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used as intended, the agent can publish posts, replies, quotes, threads, and media to the user's X/Twitter account.

Why it was flagged

The skill can take account-mutating actions by publishing tweets when the user asks. This is purpose-aligned, but public posting is high-impact and should be reviewed carefully.

Skill content
When the user asks to publish content to X/Twitter: ... Try `post` first when the user intent is to publish content.
Recommendation

Only invoke posting when you are ready to publish, and review the final text, media, and target tweet before authorizing or confirming.

What this means

Your API key and OAuth authorization enable the skill to access Twitter/X data and post through the configured account.

Why it was flagged

The skill requires an AIsa API key and uses OAuth for Twitter posting. This credential use is expected for the integration, but it gives the relay authority to perform Twitter actions.

Skill content
requires":{"bins":["curl","python3"],"env":["AISA_API_KEY"]},"primaryEnv":"AISA_API_KEY"
Recommendation

Use a dedicated API key if possible, authorize only the intended Twitter/X account, and revoke access if you no longer use the skill.

What this means

Images or videos you attach for posting leave the local workspace and are sent to the AIsa relay and then to Twitter/X.

Why it was flagged

User-selected local media is transmitted to an external relay before being posted to Twitter/X. This is disclosed and purpose-aligned, but it is a sensitive data flow.

Skill content
The Python client reads the local file and sends it to the relay backend as `multipart/form-data`. The relay backend uploads the media to Twitter/X and then publishes the tweet.
Recommendation

Attach only files you intend to publish, and avoid sending private or sensitive media unless you understand it will be uploaded externally.