ClawHub

X Research But Cheaper

v1.0.1

X/Twitter research skill powered by TwitterAPI.io. Agentic search, profile analysis, thread reading, watchlists, and sourced briefings. Use when asked to sea...

⭐ 0· 749·2 current·2 all-time
by@minilozio
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description map to code and instructions: the tool only needs a TWITTERAPI_KEY, talks to api.twitterapi.io, provides search/profile/thread/watchlist/cache features, and requires Node to run the included TypeScript CLI. Requested items are proportionate to its purpose.
✓
Instruction Scope
SKILL.md instructs running the included TypeScript CLI (npx tsx x-search.ts) and setting TWITTERAPI_KEY. Runtime behavior is limited to calling TwitterAPI.io endpoints, local caching (data/cache), and watchlist storage (data/watchlist.json). It does not instruct reading unrelated credentials or system paths.
ℹ
Install Mechanism
There is no packaged install spec (it's effectively instruction-first) and the scripts are TypeScript. The docs say "no npm install needed — zero dependencies" but runtime examples use `npx tsx ...` which may transiently fetch the `tsx` runner from the npm registry if not installed locally. That's a common pattern but does mean a network fetch of a runner package at execution time (moderate-risk compared to a purely local binary). No downloads from arbitrary URLs or extraction of archives are present.
✓
Credentials
Only TWITTERAPI_KEY is declared as the primary credential and is used consistently by the api wrapper. No other SECRET/TOKEN env vars or unrelated credentials are requested. The SKILL.md and code read only process.env.TWITTERAPI_KEY.
✓
Persistence & Privilege
The skill does local persistence only (data/cache and data/watchlist.json) and does not request always:true or modify other skills or global agent settings. It will write cache/watchlist files in its own skill directory.
Assessment
This skill appears to be what it says: a CLI wrapper around TwitterAPI.io. Before installing, note: 1) it requires a TwitterAPI.io API key (TWITTERAPI_KEY) — only provide that credential if you trust twitterapi.io and want the skill to make requests on your behalf; the code does not print the key but agent session logs could capture tool calls, so prefer a system env var and ensure your agent does not log secrets. 2) The tool reads/writes local files under the skill directory (data/cache and data/watchlist.json) — expect local cache/watchlist files to be created. 3) Running commands uses `npx tsx ...` which may transiently download the `tsx` runner from npm if you don't already have it installed; if you prefer to avoid on-the-fly npm fetches, install a local runner or compile ahead of time. 4) The repository and endpoints are visible in the code (api.twitterapi.io); if you have policy concerns, verify the third-party service and its pricing. Overall the bundle is coherent and proportionate to its stated purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk97eyhc330ay5g18ya9me7r9hx81f02v

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🐦 Clawdis
Binsnode, npx
Primary envTWITTERAPI_KEY

Comments