X Reader

Read X (Twitter) posts without official API. Supports both Nitter (free) and RapidAPI (detailed) methods.

Security Scan

The skill's code and instructions are consistent with its stated purpose (reading X/Twitter posts via Nitter or RapidAPI); it only makes network requests to the listed services and optionally uses a RapidAPI key.

Purpose & Capability

Name/description match the behavior: code implements Nitter-based scraping and an optional RapidAPI call for tweet details. No unrelated credentials, binaries, or system paths are requested.

Instruction Scope

SKILL.md and the script limit actions to fetching tweets via Nitter instances or RapidAPI. Note: the script issues HTTP requests to third-party Nitter instances and to twitter-api45.p.rapidapi.com; this is expected but means requests (and tweet content) go to those external hosts.

Install Mechanism

Instruction-only install: SKILL.md recommends 'pip install requests' only. There is no download-from-URL, archive extraction, or other install that would write arbitrary code to disk beyond the provided script.

Credentials

Registry metadata lists no required env vars, while SKILL.md and the script accept an optional RAPIDAPI_KEY. This is reasonable and limited, but the registry could explicitly mark RAPIDAPI_KEY as optional. Supplying the key will send it to RapidAPI when used.

Persistence & Privilege

Skill does not request permanent/always-on presence and does not modify other skills or system-wide settings. It runs as a simple CLI script.

Assessment

This skill appears to do exactly what it says: fetch tweets either by scraping public Nitter instances or by calling RapidAPI when you provide RAPIDAPI_KEY. Consider the following before installing: (1) If you provide a RapidAPI key it will be sent to twitter-api45.p.rapidapi.com — only use a key you trust and avoid sharing high-privilege credentials. (2) Nitter instances are third-party services; requests and scraped content go to those hosts (privacy/availability varies by instance). (3) The registry metadata doesn't mark RAPIDAPI_KEY as optional; if you want that reflected, ask the publisher to update the registry. (4) Run this untrusted script in a sandbox if you want to be extra cautious. Overall the skill is coherent with its purpose.

Read X (Twitter) posts without official API key.

Features

• Nitter Mode (Default): Free, no API key required
• RapidAPI Mode: Detailed tweet info with API key
• Simple CLI interface
• JSON output for easy integration

Usage

Basic (Nitter - Free)

python3 x-reader.py "https://x.com/username/status/1234567890"

Advanced (RapidAPI - Detailed)

export RAPIDAPI_KEY="your_rapidapi_key"
python3 x-reader.py "https://x.com/username/status/1234567890"

Output Format

{
  "id": "1234567890",
  "text": "Tweet content...",
  "author": "Display Name",
  "username": "username",
  "created_at": "2024-01-01T00:00:00.000Z",
  "likes": 100,
  "retweets": 50,
  "replies": 25,
  "url": "https://x.com/username/status/1234567890"
}

Notes

• Nitter mode may have rate limits
• RapidAPI free tier: 100 requests/month
• For production use, consider RapidAPI paid tier