X Search Bwm

Search X (Twitter) posts using the xAI API. Use when the user wants to find tweets, search X/Twitter, look up what people are saying on X, or find social med...

Security Scan

The skill's code, runtime instructions, and required resources are consistent with its stated purpose of searching X via the xAI Responses API; required items (python3 and XAI_API_KEY) are proportional and the install uses Homebrew Python.

Purpose & Capability

Name/description, required binary (python3), and required env var (XAI_API_KEY) directly match the implementation: a Python script that calls the xAI Responses API to run an x_search tool. There are no unrelated credentials or unnecessary binaries requested.

Instruction Scope

SKILL.md only instructs the user to set XAI_API_KEY and run the provided Python script. The script reads only that environment variable, accepts command-line flags, and performs a POST to api.x.ai. It does not read other files, system-wide config, or unrelated environment variables, nor does it exfiltrate data to unknown endpoints.

Install Mechanism

Install spec uses a standard Homebrew formula (python) to provide python3. No arbitrary downloads, extract steps, or third‑party installers are present. This is a low-risk, conventional install approach.

Credentials

Only XAI_API_KEY is required and declared as the primary credential. The key is used exclusively in the Authorization header when contacting https://api.x.ai/v1/responses. No other secrets, tokens, or unrelated environment variables or config paths are requested.

Persistence & Privilege

The skill is not forced always-on (always:false). It does not modify other skills or system configuration. The default ability for the model to invoke the skill autonomously is enabled, which is normal, and is not combined with other elevated privileges here.

Assessment

This skill appears coherent and limited in scope, but before installing: (1) Treat XAI_API_KEY as sensitive — create a minimal-scope/ephemeral API key if possible and do not reuse high-privilege keys. (2) Confirm you trust the skill owner/source (homepage points to docs.x.ai, but owner ID is unknown). (3) Review the included search.py yourself (it is small and readable) and run tests locally in a safe environment. (4) Be aware the script sends your query text to api.x.ai (expected for this functionality). (5) If you want stricter containment, run the script in a sandbox or on a machine/network where the API key is isolated.

X Search

Search X (Twitter) posts using the xAI Grok API with real-time access to X content.

Setup

1. Get your API key: https://console.x.ai
2. Set environment variable:

   export XAI_API_KEY="xai-your-key-here"
   

3. Or set skills."x-search".apiKey / skills."x-search".env.XAI_API_KEY in ~/.openclaw/openclaw.json

Usage

python3 {baseDir}/scripts/search.py "what is trending in AI right now"

Useful flags:

# Filter by handles (max 10)
python3 {baseDir}/scripts/search.py --handles jaaneek,OpenClaw "latest posts"

# Exclude handles (max 10)
python3 {baseDir}/scripts/search.py --exclude spambot,crypto_shill "trending AI"

# Date range (YYYY-MM-DD)
python3 {baseDir}/scripts/search.py --from 2026-03-01 --to 2026-03-20 "xAI grok updates"

# Enable image/video understanding in posts
python3 {baseDir}/scripts/search.py --images --video "product demos"

Notes

• Uses the xAI Responses API with x_search tool (Grok performs the search and summarizes results)
• Cannot use --handles and --exclude at the same time
• Results include citations with links to original X posts
• Present results in a readable format with post content, authors, and citations