Opentwitter

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can use the documented commands to query Twitter/X-related data through the 6551 API.

Why it was flagged

The skill exposes direct curl-based API operations. This is purpose-aligned for an API data skill, but users should understand that requests are made directly to the external service.

Skill content
curl -s -X POST "https://ai.6551.io/open/twitter_search" ... -H "Authorization: Bearer $TWITTER_TOKEN"
Recommendation

Use the skill for intended queries only and review requested usernames, search terms, and limits before allowing broad automated use.

What this means

Anyone or any agent process using this skill with the environment variable can make authenticated 6551 API requests under that token.

Why it was flagged

The skill requires a bearer token for the 6551 API. This is disclosed and expected, but the token is still delegated account authority.

Skill content
All endpoints require a Bearer token via `$TWITTER_TOKEN`.
Recommendation

Provide a scoped token if available, keep it out of logs and shared sessions, and revoke it if you stop using the skill.

What this means

Users have less registry-level context for who maintains the skill and where to verify it.

Why it was flagged

The package provenance is not fully described. There is no included executable code beyond instructions, so this is a provenance notice rather than a concrete unsafe behavior.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify that the publisher and 6551 API endpoint are trusted before installing or providing a token.

What this means

Twitter/X usernames, search terms, and the bearer token are transmitted to the 6551 API when the skill is used.

Why it was flagged

The skill sends authenticated requests and query parameters to an external provider. This is disclosed and purpose-aligned, but it is a data boundary users should notice.

Skill content
**Base URL**: `https://ai.6551.io`
Recommendation

Do not send sensitive private inputs as search parameters unless you are comfortable sharing them with the provider.