Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

X/Twitter Automation: 30+ APIs, OAuth Post, One Key

v1.0.3

Searches and reads X (Twitter): profiles, timelines, mentions, followers, tweet search, trends, lists, communities, and Spaces. Publishes posts after the use...

4· 3.5k·12 current·12 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the included code and SKILL.md: read/search endpoints and OAuth-based posting. Requiring curl and python3 and a single AISA_API_KEY is consistent with using a relay service. However, the skill does not call Twitter's official APIs directly; all traffic is proxied through https://api.aisa.one, which centralizes control over reads and writes under that external service.
!
Instruction Scope
The runtime instructions and Python scripts will upload local workspace files (images/videos) to the relay backend and then the relay uploads to X/Twitter. The SKILL.md also instructs agents to 'try post first' when the user intent is to publish, which could lead to automatic posting behavior if the agent interprets user intent permissively. The scripts read local workspace file paths and send file contents over network — appropriate for posting but a privacy/exfiltration vector that should be explicit to users.
Install Mechanism
This is an instruction-only skill with bundled Python scripts; there is no external install or download step. No third‑party binary downloads or archive extraction are specified, so installation risk is low from that angle.
!
Credentials
The declared required env var is only AISA_API_KEY (consistent with the relay model), which is proportionate to the intended functionality — but the code also reads other env vars (e.g., TWITTER_RELAY_BASE_URL, TWITTER_RELAY_TIMEOUT) that are not declared in metadata. More importantly, the single AISA_API_KEY is powerful: possession of it gives the holder the ability to read data and publish posts via the relay for any OAuth flows the relay supports. Users should treat that key as a high‑privilege secret and ensure they trust the relay operator (aisa.one).
Persistence & Privilege
always:false and default autonomous invocation are used. Autonomous invocation plus an API key that can publish is a meaningful combination (the agent could post on behalf of users if invoked), but autonomous invocation itself is the platform default — this is noted rather than flagged as an isolated problem.
What to consider before installing
What to consider before installing: - Trust model: this skill proxies all Twitter/X reads and writes through a third‑party relay (api.aisa.one). Installing it means your AISA_API_KEY will be used to query and to publish via that service — only install if you trust aisa.one and its security/privacy practices. - Secret power: the single AISA_API_KEY is a high‑privilege credential. If leaked or misused it could allow reads and posts via the relay. Use a scoped or revocable key if possible and rotate it if you suspect compromise. - Media handling / privacy: when posting, the skill will upload local workspace files (images/videos) to the relay backend. Treat that as data exfiltration to an external service — don’t use it with sensitive files unless you’re comfortable with that transfer. - Undeclared env vars: the scripts honor TWITTER_RELAY_BASE_URL and TWITTER_RELAY_TIMEOUT (not listed in metadata). Review or set TWITTER_RELAY_BASE_URL if you want to change the target; otherwise the default points to api.aisa.one. - Posting behavior: the instructions recommend trying to post immediately for user intents to publish. Confirm whether you want the agent to attempt posting automatically; consider restricting autonomous agent actions or requiring explicit confirmation before posting live content. - Test safely: if you proceed, test with a disposable or non-production account first. Verify the OAuth flow and inspect what data is sent to the relay (especially media uploads). If you can get more info from the publisher (proof-of-ownership of aisa.one endpoints, privacy policy, or ability to use your own relay URL), that would raise confidence. Without that, treat the skill as coherent but carrying meaningful privacy and trust risks.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🐦 Clawdis
Binscurl, python3
EnvAISA_API_KEY
Primary envAISA_API_KEY
latestvk97eyqjmbtjfazzsg0sbkz5hx983z2e1
3.5kdownloads
4stars
3versions
Updated 1h ago
v1.0.3
MIT-0

OpenClaw Twitter 🐦

Twitter/X data access and automation for autonomous agents. Powered by AIsa.

One API key. Full Twitter intelligence.

What Can You Do?

Monitor Influencers

"Get Elon Musk's latest tweets and notify me of any AI-related posts"

Track Trends

"What's trending on Twitter worldwide right now?"

Social Listening

"Search for tweets mentioning our product and analyze sentiment"

Competitor Intel

"Monitor @anthropic and @GoogleAI - alert me on new announcements"

Posting Workflows

This file does not define publishing logic.

If the user asks to send, publish, or reply, or quote on X/Twitter, handle that workflow with ./references/post_twitter.md.

Quick Start

export AISA_API_KEY="your-key"

Core Capabilities

Read Operations (No Login Required)

User Endpoints

# Get user info
curl "https://api.aisa.one/apis/v1/twitter/user/info?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user profile about (account country, verification, username changes)
curl "https://api.aisa.one/apis/v1/twitter/user_about?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Batch get user info by IDs
curl "https://api.aisa.one/apis/v1/twitter/user/batch_info_by_ids?userIds=44196397,123456" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user's latest tweets
curl "https://api.aisa.one/apis/v1/twitter/user/last_tweets?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user mentions
curl "https://api.aisa.one/apis/v1/twitter/user/mentions?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user followers
curl "https://api.aisa.one/apis/v1/twitter/user/followers?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user followings
curl "https://api.aisa.one/apis/v1/twitter/user/followings?userName=elonmusk" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get user verified followers (requires user_id, not userName)
curl "https://api.aisa.one/apis/v1/twitter/user/verifiedFollowers?user_id=44196397" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Check follow relationship between two users
curl "https://api.aisa.one/apis/v1/twitter/user/check_follow_relationship?source_user_name=elonmusk&target_user_name=BillGates" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search users by keyword
curl "https://api.aisa.one/apis/v1/twitter/user/search?query=AI+researcher" \
  -H "Authorization: Bearer $AISA_API_KEY"

Tweet Endpoints

# Advanced tweet search (queryType is required: Latest or Top)
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Latest" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search top tweets
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=AI+agents&queryType=Top" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweets by IDs (comma-separated)
curl "https://api.aisa.one/apis/v1/twitter/tweets?tweet_ids=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet replies
curl "https://api.aisa.one/apis/v1/twitter/tweet/replies?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet quotes
curl "https://api.aisa.one/apis/v1/twitter/tweet/quotes?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet retweeters
curl "https://api.aisa.one/apis/v1/twitter/tweet/retweeters?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get tweet thread context (full conversation thread)
curl "https://api.aisa.one/apis/v1/twitter/tweet/thread_context?tweetId=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get article by tweet ID
curl "https://api.aisa.one/apis/v1/twitter/article?tweet_id=1895096451033985024" \
  -H "Authorization: Bearer $AISA_API_KEY"

Trends, Lists, Communities & Spaces

# Get trending topics (worldwide)
curl "https://api.aisa.one/apis/v1/twitter/trends?woeid=1" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get list members
curl "https://api.aisa.one/apis/v1/twitter/list/members?list_id=1585430245762441216" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get list followers
curl "https://api.aisa.one/apis/v1/twitter/list/followers?list_id=1585430245762441216" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get community info
curl "https://api.aisa.one/apis/v1/twitter/community/info?community_id=1708485837274263614" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get community members
curl "https://api.aisa.one/apis/v1/twitter/community/members?community_id=1708485837274263614" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get community moderators
curl "https://api.aisa.one/apis/v1/twitter/community/moderators?community_id=1708485837274263614" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get community tweets
curl "https://api.aisa.one/apis/v1/twitter/community/tweets?community_id=1708485837274263614" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search tweets from all communities
curl "https://api.aisa.one/apis/v1/twitter/community/get_tweets_from_all_community?query=AI" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get Space detail
curl "https://api.aisa.one/apis/v1/twitter/spaces/detail?space_id=1dRJZlbLkjexB" \
  -H "Authorization: Bearer $AISA_API_KEY"

Python Client

# User operations
python3 {baseDir}/scripts/twitter_client.py user-info --username elonmusk
python3 {baseDir}/scripts/twitter_client.py user-about --username elonmusk
python3 {baseDir}/scripts/twitter_client.py tweets --username elonmusk
python3 {baseDir}/scripts/twitter_client.py mentions --username elonmusk
python3 {baseDir}/scripts/twitter_client.py followers --username elonmusk
python3 {baseDir}/scripts/twitter_client.py followings --username elonmusk
python3 {baseDir}/scripts/twitter_client.py verified-followers --user-id 44196397
python3 {baseDir}/scripts/twitter_client.py check-follow --source elonmusk --target BillGates

# Search & discovery
python3 {baseDir}/scripts/twitter_client.py search --query "AI agents"
python3 {baseDir}/scripts/twitter_client.py search --query "AI agents" --type Top
python3 {baseDir}/scripts/twitter_client.py user-search --query "AI researcher"
python3 {baseDir}/scripts/twitter_client.py trends --woeid 1

# Tweet operations
python3 {baseDir}/scripts/twitter_client.py detail --tweet-ids 1895096451033985024
python3 {baseDir}/scripts/twitter_client.py replies --tweet-id 1895096451033985024
python3 {baseDir}/scripts/twitter_client.py quotes --tweet-id 1895096451033985024
python3 {baseDir}/scripts/twitter_client.py retweeters --tweet-id 1895096451033985024
python3 {baseDir}/scripts/twitter_client.py thread --tweet-id 1895096451033985024

# List operations
python3 {baseDir}/scripts/twitter_client.py list-members --list-id 1585430245762441216
python3 {baseDir}/scripts/twitter_client.py list-followers --list-id 1585430245762441216

# Community operations
python3 {baseDir}/scripts/twitter_client.py community-info --community-id 1708485837274263614
python3 {baseDir}/scripts/twitter_client.py community-members --community-id 1708485837274263614
python3 {baseDir}/scripts/twitter_client.py community-tweets --community-id 1708485837274263614
python3 {baseDir}/scripts/twitter_client.py community-search --query "AI"

API Endpoints Reference

Read Endpoints (GET)

EndpointDescriptionKey Params
/twitter/user/infoGet user profileuserName
/twitter/user_aboutGet user profile aboutuserName
/twitter/user/batch_info_by_idsBatch get users by IDsuserIds
/twitter/user/last_tweetsGet user's recent tweetsuserName, cursor
/twitter/user/mentionsGet user mentionsuserName, cursor
/twitter/user/followersGet user followersuserName, cursor
/twitter/user/followingsGet user followingsuserName, cursor
/twitter/user/verifiedFollowersGet verified followersuser_id, cursor
/twitter/user/check_follow_relationshipCheck follow relationshipsource_user_name, target_user_name
/twitter/user/searchSearch users by keywordquery, cursor
/twitter/tweet/advanced_searchAdvanced tweet searchquery, queryType (Latest/Top), cursor
/twitter/tweetsGet tweets by IDstweet_ids (comma-separated)
/twitter/tweet/repliesGet tweet repliestweetId, cursor
/twitter/tweet/quotesGet tweet quotestweetId, cursor
/twitter/tweet/retweetersGet tweet retweeterstweetId, cursor
/twitter/tweet/thread_contextGet tweet thread contexttweetId, cursor
/twitter/articleGet article by tweettweet_id
/twitter/trendsGet trending topicswoeid (1=worldwide)
/twitter/list/membersGet list memberslist_id, cursor
/twitter/list/followersGet list followerslist_id, cursor
/twitter/community/infoGet community infocommunity_id
/twitter/community/membersGet community memberscommunity_id, cursor
/twitter/community/moderatorsGet community moderatorscommunity_id, cursor
/twitter/community/tweetsGet community tweetscommunity_id, cursor
/twitter/community/get_tweets_from_all_communitySearch all community tweetsquery, cursor
/twitter/spaces/detailGet Space detailspace_id

Pricing

APICost
Twitter read query~$0.0004

Every response includes usage.cost and usage.credits_remaining.

Get Started

  1. Sign up at aisa.one
  2. Get your API key
  3. Add credits (pay-as-you-go)
  4. Set environment variable: export AISA_API_KEY="your-key"

Full API Reference

See API Reference for complete endpoint documentation.

Comments

Loading comments...