Wip X

X Platform API. Read posts, search tweets, post, upload media.

Security Scan

The skill is generally what it claims (an X/Twitter API client) but contains several inconsistencies and secret-handling behaviors (1Password CLI use, mismatched declared requirements) that merit review before installing or granting credentials.

Purpose & Capability

Name, README, SKILL.md and code all implement an X Platform (Twitter) client with read/write functionality; the required OAuth/bearer credentials are appropriate for that purpose. However the registry metadata claims no required env vars/credentials while SKILL.md and the code clearly expect multiple X-related credentials — an inconsistency that could mislead users about what secrets will be needed.

Instruction Scope

Runtime instructions and code access credentials via environment variables and via the 1Password CLI (op read) using child_process.execSync. That behavior is consistent with the README/README troubleshooting text, but the code's default 1Password item name differs from README/SKILL.md, and the code will execute a system command to read secrets if op is available. The skill also exposes an MCP server that will accept tool calls (read/write) — make sure you understand which agent contexts can invoke those tools.

Install Mechanism

There is no install spec (instruction-only in registry) which reduces install risk, but the package includes Node code and an npm dependency (@xdevplatform/xdk) referenced in package.json and package-lock (resolved from npm). No downloads from arbitrary URLs were observed. One mismatch: mcp-server imports @modelcontextprotocol/sdk but that dependency is not listed in package.json, which is an implementation/packaging inconsistency (may cause runtime failures).

Credentials

The code and SKILL.md require sensitive credentials (X_BEARER_TOKEN and the four OAuth 1.0a tokens) and optionally 1Password vault access (OP_VAULT / OP_ITEM). Those tokens are proportional for a read+write X client, but the registry metadata omitted them and the README/SKILL.md and auth.mjs disagree on the default 1Password item name (README says item "X Platform API"; auth.mjs defaults OP_ITEM to 'X API Key - wip-01'). This mismatch could cause unexpected credential prompts or failures and increases the chance of accidental secret exposure.

Persistence & Privilege

always:false and no claimed system-wide modifications. The skill can be invoked autonomously (default platform behavior), which combined with access to OAuth credentials increases blast radius — expected for a networked API client but worth noting. The skill itself does not request permanent system-level privileges.

What to consider before installing

This package appears to be a legitimate X/Twitter API wrapper, but review these before installing: 1) Expect to provide X credentials (bearer or full OAuth); the registry metadata omitted them — don't assume no secrets are needed. 2) The code will try to read secrets from 1Password via the 'op' CLI (executes 'op read'); confirm you want the op CLI to be used and verify the vault/item names (README vs auth.mjs disagree). 3) Only grant write-scoped OAuth tokens if you trust the code — write tokens can post or delete tweets. 4) Note the MCP server exposes tools that can be called programmatically; limit which agents or environments can run it. 5) Do a quick code review (auth.mjs, core.mjs, mcp-server.mjs) and run npm install/test in a sandboxed environment; verify dependencies and add missing ones (modelcontextprotocol sdk) before production use. If you want to proceed, prefer providing credentials via environment variables scoped to a dedicated app with minimal permissions, or run the tool in an isolated container.

X Platform API. Sensor (read) + Actuator (write). All X Platform functions in one tool.

When to Use This Skill

Sensor: Read

Use fetch_post for:

• Getting the full content of a specific tweet by URL or ID
• Reading replies, quotes, engagement metrics
• Extracting tweet data for processing

Use search_recent for:

• Finding tweets matching a query (last 7 days)
• Searching by hashtags, mentions, or keywords
• Getting raw tweet data (not AI-summarized... use wip-grok search_x for that)

Use get_bookmarks for:

• Reading the user's bookmarked tweets
• Reviewing saved content

Use get_user for:

• Looking up a user's profile, bio, follower count
• Checking if an account exists

Actuator: Write

Use post_tweet for:

• Posting new tweets
• Replying to existing tweets
• Quote-tweeting with commentary
• Posting with images or video (upload first)

Use upload_media for:

• Uploading images (PNG, JPG, GIF, WebP)
• Uploading video (MP4)
• Getting media IDs for use in post_tweet

Use delete_tweet for:

• Removing a previously posted tweet

Use bookmark_post for:

• Saving a tweet for later

Do NOT Use For

• AI-powered search summarization (use wip-grok search_web or search_x instead)
• Image generation (use wip-grok generate_image)
• Video generation (use wip-grok generate_video)
• Trending topic analysis (use wip-grok search_x for AI-summarized trends)

API Reference

fetch_post(options)

const result = await fetch_post({ id_or_url: 'https://x.com/user/status/123' });
// result: { data, includes, errors }

Options: id_or_url (required). Accepts tweet ID or full URL.

search_recent(options)

const result = await search_recent({ query: 'AI agents', max_results: 20 });
// result: { data, includes, meta, errors }

Options: query (required), max_results (10-100), start_time, end_time, sort_order

get_bookmarks(options)

const result = await get_bookmarks({ max_results: 20 });

Options: max_results, pagination_token. Requires OAuth.

get_user(options)

const result = await get_user({ username_or_id: 'parkertoddbrooks' });

Options: username_or_id (required). Accepts username (with or without @) or numeric ID.

post_tweet(options)

const result = await post_tweet({ text: 'Hello world', reply_to: '123', media_ids: ['456'] });
// result: { data: { id, text }, errors }

Options: text (required), reply_to, media_ids, quote_tweet_id. Requires OAuth.

upload_media(options)

const result = await upload_media({ file_path: './photo.jpg' });
// result: { data: { id }, errors }

Options: file_path (required), media_type (auto-detected), media_data (base64 alternative)

delete_tweet(options)

const result = await delete_tweet({ id: '123456' });

Options: id (required). Requires OAuth.

Troubleshooting

"X Platform API credentials not found"

Set X_BEARER_TOKEN for read-only, or all four OAuth tokens for read+write. 1Password: vault "Agent Secrets", item "X Platform API".

"Could not resolve authenticated user ID"

Bookmarks and write operations need OAuth 1.0a (all four tokens), not just bearer token.

403 Forbidden on post/delete

Your app needs "Read and Write" permissions in the X Developer Portal. Check at https://developer.x.com/en/portal/dashboard

Rate limits

X API v2 has per-endpoint rate limits. The SDK handles rate limit headers automatically. If you hit limits, back off and retry.

API Documentation

• X API v2: https://docs.x.com/x-api
• XDK SDK: https://github.com/xdevplatform/xdk
• Authentication: https://docs.x.com/resources/authentication