Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

X/Twitter Research

v1.0.0

Research trending topics, tweets, user profiles, and conversations on X (Twitter) using twitterapi.io for insights and trend reports.

0· 433·2 current·2 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for 0xartex/x-research-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "X/Twitter Research" (0xartex/x-research-skill) from ClawHub.
Skill page: https://clawhub.ai/0xartex/x-research-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install x-research-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install x-research-skill
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md and the included script legitimately call twitterapi.io endpoints for Twitter/X research, which matches the name/description. However, the skill metadata declares no required credentials or binaries while the instructions and script rely on an API key (TWITTERAPI_KEY) and common tools (curl, jq). Also the script uses a hard-coded absolute default output directory (/home/artex/.openclaw/...), which is inconsistent with a general-purpose research skill and suggests sloppy packaging.
!
Instruction Scope
Runtime instructions require sourcing ~/.openclaw/secrets/twitterapi.env (to obtain TWITTERAPI_KEY) and then only make requests to api.twitterapi.io — no unexpected external endpoints. That is appropriate for the stated purpose. The concerns: (1) instructions and script reference a specific secrets path and a hard-coded /home/artex output path (may cause writes to another user's directory or fail unexpectedly), and (2) the skill does not declare or validate the external tools it expects (curl, jq).
Install Mechanism
There is no install spec (instruction-only plus a shell script), which minimizes install-time risk. That said the shipped script expects curl, jq, mkdir, head, date and will write files to disk; the package does not declare these requirements. No downloads or archive extraction are present.
!
Credentials
The skill requires a TWITTERAPI_KEY (and instructs storing it at ~/.openclaw/secrets/twitterapi.env), but the registry metadata lists no required env vars or primary credential. This mismatch is a red flag: the skill will access a secret not declared to the platform. There are no other unrelated credential requests, so the sensitivity is limited to that single API key, but it should be declared explicitly.
Persistence & Privilege
The skill does not request permanent always:true, does not alter other skills or global agent settings, and only writes reports to disk. Autonomous invocation is allowed (platform default) but not combined with other high privileges, so no elevated persistence concerns are present.
What to consider before installing
Before installing or running this skill: - Expect it to need a twitterapi.io API key (TWITTERAPI_KEY). The skill's metadata does not declare that; confirm and only provide a key you trust for this use. Store the key in a secure file and ensure it is not world-readable. - The SKILL.md and script will source ~/.openclaw/secrets/twitterapi.env — check that file to ensure it contains only the expected TWITTERAPI_KEY and nothing else. - The bundled script assumes curl and jq are available; verify those binaries exist on the agent host. Consider adding checks in the script or to the metadata. - The script's default OUTPUT_DIR is hard-coded to /home/artex/.openclaw/workspace/research. Change it to a portable path (use $HOME/.openclaw/... or pass an explicit output directory) to avoid writing into someone else's home or failing unexpectedly. - Review the script for any other hidden endpoints or modifications; run it in a sandbox or with a throwaway API key first to confirm behavior and costs. - Note rate/cost guidance in the SKILL.md and monitor API usage to avoid unexpected charges. Resolve the metadata mismatches (declare required env var(s) and required binaries) or treat this skill as untrusted until fixed.

Like a lobster shell, security has layers — review code before you run it.

latestvk973j377zxfngzqpgn03ns4k9d82myar
433downloads
0stars
1versions
Updated 7h ago
v1.0.0
MIT-0

X/Twitter Research Skill

Research trending topics, ideas, and conversations on X (Twitter) using twitterapi.io.

Authentication

API key stored at: ~/.openclaw/secrets/twitterapi.env

Load before any request:

source ~/.openclaw/secrets/twitterapi.env

Base URL: https://api.twitterapi.io

All requests need header: X-API-Key: $TWITTERAPI_KEY

Core Endpoints

1. Advanced Tweet Search

Search for tweets matching a query.

curl -s "https://api.twitterapi.io/twitter/tweet/advanced_search?query=solana&queryType=Latest" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:5]'

Parameters:

  • query — search query (supports operators like from:, to:, #hashtag)
  • queryTypeLatest or Top
  • cursor — pagination cursor

Query operators:

  • solana defi — both words
  • "solana defi" — exact phrase
  • from:solaborada — from specific user
  • #solana — hashtag
  • solana -pump — exclude word
  • solana min_faves:100 — minimum likes

2. Get Trends

Get current trending topics.

curl -s "https://api.twitterapi.io/twitter/trends" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.trends[:10]'

3. Get User's Recent Tweets

Get latest tweets from a specific account.

curl -s "https://api.twitterapi.io/twitter/user/last_tweets?userName=solana" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:5]'

4. Get User Info

Get profile info for a user.

curl -s "https://api.twitterapi.io/twitter/user/info?userName=solana" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.user'

Research Workflow

Daily Solana Trend Report

Run this workflow every 4-6 hours to generate a trend report.

Step 1: Search hot Solana topics

# General Solana buzz
curl -s "https://api.twitterapi.io/twitter/tweet/advanced_search?query=solana&queryType=Top" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:20]'

# Solana + AI intersection
curl -s "https://api.twitterapi.io/twitter/tweet/advanced_search?query=solana%20AI%20agent&queryType=Latest" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:10]'

# Solana DeFi
curl -s "https://api.twitterapi.io/twitter/tweet/advanced_search?query=solana%20defi&queryType=Latest" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:10]'

Step 2: Check key accounts

# Official Solana
curl -s "https://api.twitterapi.io/twitter/user/last_tweets?userName=solana" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:5]'

# Colosseum (hackathon organizer)
curl -s "https://api.twitterapi.io/twitter/user/last_tweets?userName=colosseum" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:5]'

# Helius (infra)
curl -s "https://api.twitterapi.io/twitter/user/last_tweets?userName=heaborada" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:5]'

# Jupiter (DEX)
curl -s "https://api.twitterapi.io/twitter/user/last_tweets?userName=JupiterExchange" \
  -H "X-API-Key: $TWITTERAPI_KEY" | jq '.tweets[:5]'

Step 3: Compile report

Create a markdown file with:

  • Top trending Solana topics
  • Notable tweets/threads
  • New project launches mentioned
  • Pain points people are discussing
  • Ideas worth building

Key Accounts to Monitor

Core Ecosystem

  • @solana — Official Solana
  • @colosseum — Hackathon organizer
  • @SolanaFndn — Solana Foundation
  • @aaboradari — Solana co-founder

Infrastructure

  • @heaborada — Helius (RPC, webhooks)
  • @triaboradi — Triton (RPC)
  • @jitoSOL — Jito (MEV, staking)

DeFi

  • @JupiterExchange — Jupiter (DEX aggregator)
  • @RaydiumProtocol — Raydium (AMM)
  • @MeteoraDEX — Meteora (LP)

AI + Crypto

  • @ai16zdao — ai16z (AI agents)
  • @virtaborada — Virtuals

Builders/VCs

  • @rajgokal — Raj (Solana co-founder)
  • @aaborada — Anatoly (Solana co-founder)
  • @multiaboradi — Multicoin Capital

Vertical-Specific Searches

DeFi

solana defi yield
solana lending protocol
solana perps trading
jupiter swap

Payments

solana payments
solana pay merchant
USDC solana

Consumer

solana consumer app
solana gaming
solana social

Infrastructure

solana rpc
solana developer tools
anchor framework

AI + Blockchain

solana AI agent
AI crypto solana
autonomous agent blockchain

Privacy

solana privacy
ZK solana
confidential transfer

Rate Limits & Costs

  • $0.15 per 1,000 tweets returned
  • $0.18 per 1,000 user profiles
  • Minimum $0.00015 per API call

Budget guidance:

  • 1,000 tweets/day = ~$0.15/day
  • 30 days = ~$4.50

Output Format

Generate reports as:

workspace/research/solana-trends-YYYY-MM-DD-HH.md

Include:

  1. Hot Topics — What's trending
  2. Key Tweets — Notable posts with links
  3. Pain Points — What people are complaining about
  4. Ideas — Opportunities mentioned or implied
  5. By Vertical — Grouped by DeFi, payments, etc.

Comments

Loading comments...