Twitter/X API

X/Twitter messaging management via API. Read tweets, post tweets, reply, send DMs, search, and view analytics. Use when the user wants to interact with X/Twi...

Security Scan

The skill appears to implement a legitimate Twitter/X CLI, but its manifest metadata does not declare the credentials and config it actually requires and the bundled script should be reviewed before use.

Purpose & Capability

Name/description match the included code and instructions (posting, reading, DMs, search, analytics). However the registry metadata lists no required environment variables or config paths while SKILL.md and scripts/tweet.py clearly require Twitter credentials (env vars or ~/.config/twitter/credentials.json). That mismatch is incoherent and could mislead users about what secrets the skill needs.

Instruction Scope

SKILL.md instructions are narrowly scoped to Twitter/X operations (posting, reading, search, DMs, analytics) and tell the user how to provide credentials and run the CLI. The runtime instructions reference only the credentials file path (~/.config/twitter/credentials.json) and environment variables needed for OAuth/Bearer tokens, which is appropriate for this purpose.

Install Mechanism

No automated install spec is provided (instruction-only), which minimizes automatic disk writes. The SKILL.md instructs users to run 'pip install tweepy' — a normal and expected dependency, but it does cause code to be pulled from PyPI at install time. The skill includes a bundled Python script that will be executed by the user/agent when invoked.

Credentials

The SKILL.md (and tweet.py) require OAuth credentials and/or a bearer token — appropriate for Twitter integration — but the registry metadata declares none. This mismatch is concerning because users may not realize the skill will read secrets from env vars or the home config file; required secrets are proportionate to the task but were not declared in the manifest.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does read/write only its own configuration path (~/.config/twitter/credentials.json) for credentials as documented. There is no indication it modifies other skills or system-wide agent settings.

What to consider before installing

This skill implements a normal Twitter/X CLI, but there are a few things to check before installing or running it: (1) The skill's registry metadata does not declare that it needs API keys or a credentials file — SKILL.md and the script do require OAuth keys or a bearer token and will read ~/.config/twitter/credentials.json if present. Treat that as a real secret requirement. (2) Review the complete scripts/tweet.py source yourself (it is bundled) for any hidden network calls or unexpected file access before running; the provided snippet appears truncated, so ask for the full source if unsure. (3) Run pip install tweepy in an isolated virtualenv or sandbox and avoid running the CLI with production credentials until you've audited it. Prefer using a read-only bearer token for non-write actions where possible. (4) If you obtained this skill from an unknown source, ask the publisher to update the manifest to list required env vars/config paths and to provide provenance (homepage, source repo, maintainer). (5) If you must proceed immediately, restrict the credentials to an account with limited privileges and monitor activity for unexpected API use.

Twitter/X API Skill

Interact with X (Twitter) via API v2 for reading, posting, replying, DMs, search, and analytics.

Setup

Credentials

Store credentials in environment variables or ~/.config/twitter/credentials.json:

export TWITTER_API_KEY="your-api-key"
export TWITTER_API_SECRET="your-api-secret"
export TWITTER_ACCESS_TOKEN="your-access-token"
export TWITTER_ACCESS_SECRET="your-access-secret"
export TWITTER_BEARER_TOKEN="your-bearer-token"  # For read-only operations

Or create credentials file:

mkdir -p ~/.config/twitter
cat > ~/.config/twitter/credentials.json << 'EOF'
{
  "api_key": "your-api-key",
  "api_secret": "your-api-secret",
  "access_token": "your-access-token",
  "access_secret": "your-access-secret",
  "bearer_token": "your-bearer-token"
}
EOF
chmod 600 ~/.config/twitter/credentials.json

Install Dependencies

pip install tweepy

Quick Reference

Task	Command
Post tweet	{baseDir}/scripts/tweet.py post "text"
Post with image	{baseDir}/scripts/tweet.py post "text" --media image.png
Reply	{baseDir}/scripts/tweet.py reply TWEET_ID "text"
Thread	{baseDir}/scripts/tweet.py thread "tweet1" "tweet2" ...
Get timeline	{baseDir}/scripts/tweet.py timeline [--count 20]
Get mentions	{baseDir}/scripts/tweet.py mentions [--count 20]
Get DMs	{baseDir}/scripts/tweet.py dms [--count 20]
Send DM	{baseDir}/scripts/tweet.py dm USERNAME "message"
Search	{baseDir}/scripts/tweet.py search "query" [--count 20]
User info	{baseDir}/scripts/tweet.py user USERNAME
Tweet info	{baseDir}/scripts/tweet.py show TWEET_ID
Analytics	{baseDir}/scripts/tweet.py analytics TWEET_ID

Scripts

tweet.py

Main script for all Twitter operations. Run with --help for details:

{baseDir}/scripts/tweet.py --help
{baseDir}/scripts/tweet.py post --help

Common Workflows

Post a simple tweet:

{baseDir}/scripts/tweet.py post "Hello, world!"

Post with image:

{baseDir}/scripts/tweet.py post "Check this out!" --media photo.png
{baseDir}/scripts/tweet.py post "Multiple images" --media img1.png --media img2.png

Reply to a tweet:

{baseDir}/scripts/tweet.py reply 1234567890 "Great point!"

Post a thread:

{baseDir}/scripts/tweet.py thread \
  "First tweet in thread" \
  "Second tweet" \
  "Third tweet"

Read your mentions:

{baseDir}/scripts/tweet.py mentions --count 50

Search for tweets:

{baseDir}/scripts/tweet.py search "openclaw agent" --count 20
{baseDir}/scripts/tweet.py search "#AI lang:en" --count 20

Get user info:

{baseDir}/scripts/tweet.py user elonmusk

Send a DM:

{baseDir}/scripts/tweet.py dm username "Hello from OpenClaw!"

View tweet analytics:

{baseDir}/scripts/tweet.py analytics 1234567890

API Tiers & Limits

Tier	Cost	Read	Write	Search
Free	$0	Limited	-	-
Basic	$100/mo	10k/mo	1.5k/mo	50/mo
Pro	$5000/mo	1M/mo	300k/mo	500/mo

Free tier can only post tweets (no read access to timeline/mentions). Basic tier required for reading mentions, timeline, and search. Write-only operations work on free tier.

See {baseDir}/references/api-limits.md for detailed rate limits.

Error Handling

Common errors:

Error	Cause	Solution
403 Forbidden	Insufficient tier	Upgrade API tier or check endpoint access
429 Too Many Requests	Rate limit hit	Wait and retry; check rate limit headers
401 Unauthorized	Invalid credentials	Verify API keys and tokens
404 Not Found	Tweet/user deleted	Handle gracefully, inform user
422 Unprocessable	Duplicate tweet	Wait before posting same content

Notes

• Rate limits: X API has strict rate limits. Scripts include retry logic.
• Media uploads: Images must be <5MB (PNG/JPG) or <15MB (GIF). Videos <512MB.
• Character limit: 280 characters per tweet. Threads for longer content.
• DMs: Require OAuth 1.0a user context (not Bearer token).
• Search operators: {baseDir}/references/search-operators.md for advanced queries.

Related Files

• {baseDir}/scripts/tweet.py - Main CLI for all operations
• {baseDir}/references/api-limits.md - Detailed rate limits by endpoint
• {baseDir}/references/search-operators.md - Twitter search syntax