x-twitter-scraper

Integrates with the X API for Twitter data extraction, enabling tweet searches, user lookups, and engagement metrics.

Install this skill

or

0/100

Security score

The x-twitter-scraper skill was audited on May 14, 2026 and we found 58 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 109

Template literal with variable interpolation in command context

SourceSKILL.md

109	const response = await fetch(`${BASE}${path}`, {

medium line 119

Template literal with variable interpolation in command context

SourceSKILL.md

119	throw new Error(`Xquik API ${response.status}: ${error.error}`);

medium line 145

Template literal with variable interpolation in command context

SourceSKILL.md

145	const data = await xquikFetch(`${path}?${params}`);

medium line 220

Template literal with variable interpolation in command context

SourceSKILL.md

220	job = await xquikFetch(`/extractions/${job.id}`);

medium line 228

Template literal with variable interpolation in command context

SourceSKILL.md

228	const path = `/extractions/${job.id}${cursor ? `?after=${cursor}` : ""}`;

medium line 238

Template literal with variable interpolation in command context

SourceSKILL.md

238	const exportUrl = `${BASE}/extractions/${job.id}/export?format=csv`;

medium line 250

Template literal with variable interpolation in command context

SourceSKILL.md

250	const user = await xquikFetch(`/x/users/${username}`);

medium line 259

Template literal with variable interpolation in command context

SourceSKILL.md

259	const tweets = await xquikFetch(`/x/tweets/search?q=from:${username}`);

medium line 345

Template literal with variable interpolation in command context

SourceSKILL.md

345	const details = await xquikFetch(`/draws/${draw.id}`);

medium line 355

Template literal with variable interpolation in command context

SourceSKILL.md

355	const exportUrl = `${BASE}/draws/${draw.id}/export?format=csv`;

low line 191

Fetch to external URL

SourceSKILL.md

191	const estimate = await xquikFetch("/extractions/estimate", {

low line 207

Fetch to external URL

SourceSKILL.md

207	const job = await xquikFetch("/extractions", {

low line 253

Fetch to external URL

SourceSKILL.md

253	const postsJob = await xquikFetch("/extractions", {

low line 263

Fetch to external URL

SourceSKILL.md

263	const estimate = await xquikFetch("/extractions/estimate", {

low line 269

Fetch to external URL

SourceSKILL.md

269	const repliesJob = await xquikFetch("/extractions", {

low line 278

Fetch to external URL

SourceSKILL.md

278	const trends = await xquikFetch("/trends?woeid=1");

low line 311

Fetch to external URL

SourceSKILL.md

311	const draw = await xquikFetch("/draws", {

low line 425

Fetch to external URL

SourceSKILL.md

425	const monitor = await xquikFetch("/monitors", {

low line 435

Fetch to external URL

SourceSKILL.md

435	const webhook = await xquikFetch("/webhooks", {

low line 445

Fetch to external URL

SourceSKILL.md

445	const events = await xquikFetch("/events?monitorId=7&limit=50");

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: "X API & Twitter scraper skill for AI coding agents. Builds integrations with the Xquik REST API, MCP server & webhooks: tweet search, user lookup, follower extraction, engagement metrics

medium line 13

Webhook reference - potential data exfiltration

SourceSKILL.md

13	Xquik is an X (Twitter) real-time data platform providing a REST API, HMAC webhooks, and an MCP server for AI agents. It covers account monitoring, bulk data extraction (20 tools), giveaway draws, twe

medium line 53

Webhook reference - potential data exfiltration

SourceSKILL.md

53	\| Receive events in real time \| `POST /webhooks` \| HMAC-signed delivery to your HTTPS endpoint \|

medium line 54

Webhook reference - potential data exfiltration

SourceSKILL.md

54	\| Update webhook \| `PATCH /webhooks/{id}` \| Change URL, event types, or pause/resume \|

medium line 91

Webhook reference - potential data exfiltration

SourceSKILL.md

91	\| 400 \| `invalid_input`, `invalid_id`, `invalid_params`, `invalid_tweet_url`, `invalid_tweet_id`, `invalid_username`, `invalid_tool_type`, `invalid_format`, `missing_query`, `missing_params`, `webhook

medium line 358

Webhook reference - potential data exfiltration

SourceSKILL.md

358	## Webhook Event Handling

medium line 360

Webhook reference - potential data exfiltration

SourceSKILL.md

360	Webhooks deliver events to your HTTPS endpoint with HMAC-SHA256 signatures. Each delivery is a POST with `X-Xquik-Signature` header and JSON body containing `eventType`, `username`, and `data`.

medium line 362

Webhook reference - potential data exfiltration

SourceSKILL.md

362	### Webhook Handler (Express)

low line 368

Webhook reference - potential data exfiltration

SourceSKILL.md

368	const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;

low line 378

Webhook reference - potential data exfiltration

SourceSKILL.md

378	app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {

low line 383

Webhook reference - potential data exfiltration

SourceSKILL.md

383	if (!signature \|\| !verifySignature(payload, signature, WEBHOOK_SECRET)) {

medium line 407

Webhook reference - potential data exfiltration

SourceSKILL.md

407	For Flask (Python) webhook handler, see [references/python-examples.md](references/python-examples.md#webhook-handler-flask).

medium line 409

Webhook reference - potential data exfiltration

SourceSKILL.md

409	Webhook security rules:

medium line 414

Webhook reference - potential data exfiltration

SourceSKILL.md

414	- Store webhook secret in environment variables, never hardcode

medium line 417

Webhook reference - potential data exfiltration

SourceSKILL.md

417	Check delivery status via `GET /webhooks/{id}/deliveries` to monitor successful and failed attempts.

medium line 421

Webhook reference - potential data exfiltration

SourceSKILL.md

421	Complete end-to-end: create monitor, register webhook, handle events.

low line 434

Webhook reference - potential data exfiltration

SourceSKILL.md

434	// 2. Register webhook

low line 435

Webhook reference - potential data exfiltration

SourceSKILL.md

435	const webhook = await xquikFetch("/webhooks", {

low line 438

Webhook reference - potential data exfiltration

SourceSKILL.md

438	url: "https://your-server.com/webhook",

low line 442

Webhook reference - potential data exfiltration

SourceSKILL.md

442	// IMPORTANT: Save webhook.secret. It is shown only once!

low line 444

Webhook reference - potential data exfiltration

SourceSKILL.md

444	// 3. Poll events (alternative to webhooks)

medium line 470

Webhook reference - potential data exfiltration

SourceSKILL.md

470	\| Webhook/monitor update \| Full PATCH via `xquik` tool \| PATCH endpoints \|

medium line 481

Webhook reference - potential data exfiltration

SourceSKILL.md

481	- Set up real-time alerts: `monitors` (action=add) -> `webhooks` (action=add) -> `webhooks` (action=test)

medium line 503

Webhook reference - potential data exfiltration

SourceSKILL.md

503	- Free: account info, monitor/webhook management, radar, extraction history, cost estimates, tweet composition (compose, refine, score), style cache management (list, get, save, delete, compare),

medium line 523

Webhook reference - potential data exfiltration

SourceSKILL.md

523	- `references/python-examples.md`: Python equivalents of all JavaScript examples (retry, extraction, draw, webhook)

medium line 524

Webhook reference - potential data exfiltration

SourceSKILL.md

524	- `references/webhooks.md`: Extended webhook examples, local testing with ngrok, delivery status monitoring

high line 524

Ngrok tunnel reference

SourceSKILL.md

524	- `references/webhooks.md`: Extended webhook examples, local testing with ngrok, delivery status monitoring

low line 368

Access to .env file

SourceSKILL.md

368	const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;

low line 4

External URL reference

SourceSKILL.md

4	compatibility: Requires internet access to call the Xquik REST API (https://xquik.com/api/v1)

low line 19

External URL reference

SourceSKILL.md

19	\| Base URL \| `https://xquik.com/api/v1` \|

low line 21

External URL reference

SourceSKILL.md

21	\| MCP endpoint \| `https://xquik.com/mcp` (StreamableHTTP, same API key) \|

low line 34

External URL reference

SourceSKILL.md

34	const BASE = "https://xquik.com/api/v1";

low line 294

External URL reference

SourceSKILL.md

294	\| `tweetUrl` \| string \| Required. Full tweet URL: `https://x.com/user/status/ID` \|

low line 314

External URL reference

SourceSKILL.md

314	tweetUrl: "https://x.com/burakbayir/status/1893456789012345678",

low line 330

External URL reference

SourceSKILL.md

330	// tweetUrl: "https://x.com/burakbayir/status/1893456789012345678",

low line 438

External URL reference

SourceSKILL.md

438	url: "https://your-server.com/webhook",

low line 453

External URL reference

SourceSKILL.md

453	The MCP server at `https://xquik.com/mcp` uses a code-execution sandbox model with 2 tools (`explore` + `xquik`). The agent writes async JavaScript arrow functions that run in a sandboxed environment

low line 455

External URL reference

SourceSKILL.md

455	Legacy v1 server at `https://xquik.com/mcp/v1` exposes 18 discrete tools with traditional input schemas. All new integrations should use the default v2 server at `/mcp`.

Scanned on May 14, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2.0K

Rate this skill

Categorymarketing

UpdatedMay 20, 2026

claude-code cursor codex copilot windsurf api cross-platform social-media-manager influencer-marketer marketing-analyst growth-marketer content-marketer telegram marketing

LeoYeAI/openclaw-master-skills