Security audit
Security checks for vulnerabilities and agentic risk
This skill uses a disclosed Sorsa API key to retrieve public X data, with no evidence of hidden collection, account changes, or background activity.
Use a dedicated Sorsa key and understand that Sorsa receives your searches. Set page limits to control request charges, and use reviewed dependency versions. The supplied metadata does not establish publisher identity.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if cursor:
body["next_cursor"] = cursor
resp = requests.post(
URL,
headers={"ApiKey": API_KEY, "Content-Type": "application/json"},
json=body,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Copy this file to .env and fill in your key.
# Get a key at https://api.sorsa.io/overview
SORSA_API_KEY=your_api_key_here
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
├── SKILL.md # the skill (frontmatter + instructions)
├── README.md
├── LICENSE
├── .env.example # copy to .env and add your key
├── requirements.txt
├── .gitignore
├── references/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Copy this file to .env and fill in your key.
# Get a key at https://api.sorsa.io/overview
SORSA_API_KEY=your_api_key_here
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Search recent popular tweets (POST with a JSON body):
curl -X POST "https://api.sorsa.io/v3/search-tweets" \
-H "ApiKey: $SORSA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "from:elonmusk min_faves:1000", "order": "popular"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Sorsa API v3 - common requests. Set SORSA_API_KEY first.
# export SORSA_API_KEY=your_key # https://api.sorsa.io/overview
set -euo pipefail
BASE="https://api.sorsa.io/v3"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"""Quickstart: fetch one X/Twitter profile via the Sorsa API.
export SORSA_API_KEY=your_key # from https://api.sorsa.io/overview
python quickstart.py elonmusk
"""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Sorsa Twitter / X API Skill
A SKILL.md agent skill that lets Claude, Cursor, Codex, and other SKILL.md-compatible
AI agents pull public **Twitter / X data** through the [Sorsa API](https://api.sorsa.io/overview):
profiles, tweets, followers, search, mentions, Communities, Lists, and crypto-focused
influence analytics (Sorsa Score).
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
export SORSA_API_KEY=your_key
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Links
- API plans and dashboard: https://api.sorsa.io/overview
- Docs: https://docs.sorsa.io/ (LLM index: https://docs.sorsa.io/llms.txt)
- OpenAPI spec: https://docs.sorsa.io/v3/openapi.json
- Analytics app: https://app.sorsa.io
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Setup
- **Base URL:** `https://api.sorsa.io/v3`
- **Auth:** every request needs an API key in the `ApiKey` header. There is no OAuth and no app registration.
- **Get a key:** sign up and pick a plan at https://api.sorsa.io/overview (the key appears in the dashboard under "Apikeys").
- **Convention:** read the key from the `SORSA_API_KEY` environment variable. Never hardcode it in committed code.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- **Base URL:** `https://api.sorsa.io/v3`
- **Auth:** every request needs an API key in the `ApiKey` header. There is no OAuth and no app registration.
- **Get a key:** sign up and pick a plan at https://api.sorsa.io/overview (the key appears in the dashboard under "Apikeys").
- **Convention:** read the key from the `SORSA_API_KEY` environment variable. Never hardcode it in committed code.
Minimal check:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Minimal check:
curl -H "ApiKey: $SORSA_API_KEY" "https://api.sorsa.io/v3/info?username=elonmusk"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
user one of three ways.** Most user endpoints accept exactly ONE of: `username` (handle without @), `user_id` (numeric, stable), or `user_link` (profile URL). Prefer `user_id` when you have it, because usernames can change but IDs never do.
**2. Paginate via cursor.** List endpoints return `next_cursor`. If it is null or absent, you have reached the end. To get the next page, pass that value back. The parameter is named `next_cursor` in both cases: for GET list endpoints (`/followers`, `/follows`, `/verified-followers`, `/list-*`) it is a query parameter; for POST endpoints it goes in the JSON body. This matches the OpenAPI spec at https://api.sorsa.io/v3/swagger.json (there is no `cursor` parameter). Page sizes: tweets, comments and quotes up to 20; followers and following up to 200.
**3. Batch when you can.** For many users or tweets, use `GET /info-batch` (up to 100 accounts) or `POST /tweet-info-bulk` (up to 100 tweets) instead of looping single calls. It is cheaper and faster.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Search recent popular tweets (POST with a JSON body):
curl -X POST "https://api.sorsa.io/v3/search-tweets" \
-H "ApiKey: $SORSA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "from:elonmusk min_faves:1000", "order": "popular"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
r = requests.get(
"https://api.sorsa.io/v3/info",
headers={"ApiKey": os.environ["SORSA_API_KEY"]},
params={"username": "elonmusk"},
)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Getting access
If the user does not have a key yet, point them to https://api.sorsa.io/overview to pick a plan (the entry tier starts at 10K requests). Pricing is per request and sits well below the official X API for the same volume.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# export SORSA_API_KEY=your_key # https://api.sorsa.io/overview
set -euo pipefail
BASE="https://api.sorsa.io/v3"
AUTH="ApiKey: ${SORSA_API_KEY}"
JSON="Content-Type: application/json"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
username = sys.argv[1] if len(sys.argv) > 1 else "elonmusk"
resp = requests.get(
"https://api.sorsa.io/v3/info",
headers={"ApiKey": os.environ["SORSA_API_KEY"]},
params={"username": username},
timeout=60,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
QUERY = sys.argv[1] if len(sys.argv) > 1 else "ethereum"
MAX_PAGES = 3
API_KEY = os.environ["SORSA_API_KEY"]
URL = "https://api.sorsa.io/v3/search-tweets"
cursor = None
seen = 0
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Sorsa API v3 Reference
- **Base URL:** `https://api.sorsa.io/v3`
- **Auth:** `ApiKey: YOUR_API_KEY` header on every request.
- **Docs:** https://docs.sorsa.io/ (LLM index: https://docs.sorsa.io/llms.txt)
- **OpenAPI:** https://docs.sorsa.io/v3/openapi.json (Swagger: https://api.sorsa.io/v3/swagger.json)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- **Base URL:** `https://api.sorsa.io/v3`
- **Auth:** `ApiKey: YOUR_API_KEY` header on every request.
- **Docs:** https://docs.sorsa.io/ (LLM index: https://docs.sorsa.io/llms.txt)
- **OpenAPI:** https://docs.sorsa.io/v3/openapi.json (Swagger: https://api.sorsa.io/v3/swagger.json)
HTTP status codes (all endpoints): `200` OK, `400` bad params, `401` bad/missing key, `403` forbidden, `404` not found, `429` rate limited, `500` server error. Errors return `{"message": "..."}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
passed explicitly. Requires `requests` (pip install requests).
Docs: https://docs.sorsa.io/ (LLM index: https://docs.sorsa.io/llms.txt)
Get a key: https://api.sorsa.io/overview
"""
from __future__ import annotations
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not self.api_key:
raise RuntimeError(
"No API key. Set SORSA_API_KEY or pass api_key=. "
"Get one at https://api.sorsa.io/overview"
)
self.base_url = base_url.rstrip("/")
self.max_retries = max_retries