x-twitter-scraper

Automates Twitter interactions and data extraction using the X API, enabling efficient account monitoring and engagement analysis.

Install this skill

or

0/100

Security score

The x-twitter-scraper skill was audited on May 14, 2026 and we found 59 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 119

Template literal with variable interpolation in command context

SourceSKILL.md

119	const response = await fetch(`${BASE}${path}`, {

medium line 129

Template literal with variable interpolation in command context

SourceSKILL.md

129	throw new Error(`Xquik API ${response.status}: ${error.error}`);

medium line 155

Template literal with variable interpolation in command context

SourceSKILL.md

155	const data = await xquikFetch(`${path}?${params}`);

medium line 230

Template literal with variable interpolation in command context

SourceSKILL.md

230	job = await xquikFetch(`/extractions/${job.id}`);

medium line 238

Template literal with variable interpolation in command context

SourceSKILL.md

238	const path = `/extractions/${job.id}${cursor ? `?after=${cursor}` : ""}`;

medium line 248

Template literal with variable interpolation in command context

SourceSKILL.md

248	const exportUrl = `${BASE}/extractions/${job.id}/export?format=csv`;

medium line 260

Template literal with variable interpolation in command context

SourceSKILL.md

260	const user = await xquikFetch(`/x/users/${username}`);

medium line 269

Template literal with variable interpolation in command context

SourceSKILL.md

269	const tweets = await xquikFetch(`/x/tweets/search?q=from:${username}`);

medium line 355

Template literal with variable interpolation in command context

SourceSKILL.md

355	const details = await xquikFetch(`/draws/${draw.id}`);

medium line 365

Template literal with variable interpolation in command context

SourceSKILL.md

365	const exportUrl = `${BASE}/draws/${draw.id}/export?format=csv`;

low line 201

Fetch to external URL

SourceSKILL.md

201	const estimate = await xquikFetch("/extractions/estimate", {

low line 217

Fetch to external URL

SourceSKILL.md

217	const job = await xquikFetch("/extractions", {

low line 263

Fetch to external URL

SourceSKILL.md

263	const postsJob = await xquikFetch("/extractions", {

low line 273

Fetch to external URL

SourceSKILL.md

273	const estimate = await xquikFetch("/extractions/estimate", {

low line 279

Fetch to external URL

SourceSKILL.md

279	const repliesJob = await xquikFetch("/extractions", {

low line 288

Fetch to external URL

SourceSKILL.md

288	const trends = await xquikFetch("/trends?woeid=1");

low line 321

Fetch to external URL

SourceSKILL.md

321	const draw = await xquikFetch("/draws", {

low line 435

Fetch to external URL

SourceSKILL.md

435	const monitor = await xquikFetch("/monitors", {

low line 445

Fetch to external URL

SourceSKILL.md

445	const webhook = await xquikFetch("/webhooks", {

low line 455

Fetch to external URL

SourceSKILL.md

455	const events = await xquikFetch("/events?monitorId=7&limit=50");

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: "X API & Twitter automation skill. Build integrations with the Xquik REST API, MCP server & webhooks: tweet search, user lookup, follower extraction, engagement metrics, giveaway draws, t

medium line 10

Webhook reference - potential data exfiltration

SourceSKILL.md

10	- Setting up account monitors or webhook event delivery

medium line 21

Webhook reference - potential data exfiltration

SourceSKILL.md

21	Xquik is an X (Twitter) real-time data platform providing a REST API, HMAC webhooks, and an MCP server for AI agents. It covers account monitoring, bulk data extraction (20 tools), giveaway draws, twe

medium line 61

Webhook reference - potential data exfiltration

SourceSKILL.md

61	\| Receive events in real time \| `POST /webhooks` \| HMAC-signed delivery to your HTTPS endpoint \|

medium line 62

Webhook reference - potential data exfiltration

SourceSKILL.md

62	\| Update webhook \| `PATCH /webhooks/{id}` \| Change URL, event types, or pause/resume \|

medium line 101

Webhook reference - potential data exfiltration

SourceSKILL.md

101	\| 400 \| `invalid_input`, `invalid_id`, `invalid_params`, `invalid_tweet_url`, `invalid_tweet_id`, `invalid_username`, `invalid_tool_type`, `invalid_format`, `invalid_json`, `missing_query`, `missing_p

medium line 368

Webhook reference - potential data exfiltration

SourceSKILL.md

368	## Webhook Event Handling

medium line 370

Webhook reference - potential data exfiltration

SourceSKILL.md

370	Webhooks deliver events to your HTTPS endpoint with HMAC-SHA256 signatures. Each delivery is a POST with `X-Xquik-Signature` header and JSON body containing `eventType`, `username`, and `data`.

medium line 372

Webhook reference - potential data exfiltration

SourceSKILL.md

372	### Webhook Handler (Express)

low line 378

Webhook reference - potential data exfiltration

SourceSKILL.md

378	const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;

low line 388

Webhook reference - potential data exfiltration

SourceSKILL.md

388	app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {

low line 393

Webhook reference - potential data exfiltration

SourceSKILL.md

393	if (!signature \|\| !verifySignature(payload, signature, WEBHOOK_SECRET)) {

medium line 417

Webhook reference - potential data exfiltration

SourceSKILL.md

417	For Flask (Python) webhook handler, see [references/python-examples.md](references/python-examples.md#webhook-handler-flask).

medium line 419

Webhook reference - potential data exfiltration

SourceSKILL.md

419	Webhook security rules:

medium line 424

Webhook reference - potential data exfiltration

SourceSKILL.md

424	- Store webhook secret in environment variables, never hardcode

medium line 427

Webhook reference - potential data exfiltration

SourceSKILL.md

427	Check delivery status via `GET /webhooks/{id}/deliveries` to monitor successful and failed attempts.

medium line 431

Webhook reference - potential data exfiltration

SourceSKILL.md

431	Complete end-to-end: create monitor, register webhook, handle events.

low line 444

Webhook reference - potential data exfiltration

SourceSKILL.md

444	// 2. Register webhook

low line 445

Webhook reference - potential data exfiltration

SourceSKILL.md

445	const webhook = await xquikFetch("/webhooks", {

low line 448

Webhook reference - potential data exfiltration

SourceSKILL.md

448	url: "https://your-server.com/webhook",

low line 452

Webhook reference - potential data exfiltration

SourceSKILL.md

452	// IMPORTANT: Save webhook.secret. It is shown only once!

low line 454

Webhook reference - potential data exfiltration

SourceSKILL.md

454	// 3. Poll events (alternative to webhooks)

medium line 480

Webhook reference - potential data exfiltration

SourceSKILL.md

480	\| Webhook/monitor update \| Full PATCH via `xquik` tool \| PATCH endpoints \|

medium line 491

Webhook reference - potential data exfiltration

SourceSKILL.md

491	- Set up real-time alerts: `monitors` (action=add) -> `webhooks` (action=add) -> `webhooks` (action=test)

medium line 514

Webhook reference - potential data exfiltration

SourceSKILL.md

514	- Free: account info, monitor/webhook management, radar, extraction history, cost estimates, tweet composition (compose, refine, score), style cache management (list, get, save, delete, compare),

medium line 534

Webhook reference - potential data exfiltration

SourceSKILL.md

534	- `references/python-examples.md`: Python equivalents of all JavaScript examples (retry, extraction, draw, webhook)

medium line 535

Webhook reference - potential data exfiltration

SourceSKILL.md

535	- `references/webhooks.md`: Extended webhook examples, local testing with ngrok, delivery status monitoring

high line 535

Ngrok tunnel reference

SourceSKILL.md

535	- `references/webhooks.md`: Extended webhook examples, local testing with ngrok, delivery status monitoring

low line 378

Access to .env file

SourceSKILL.md

378	const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;

low line 4

External URL reference

SourceSKILL.md

4	homepage: https://xquik.com

low line 27

External URL reference

SourceSKILL.md

27	\| Base URL \| `https://xquik.com/api/v1` \|

low line 29

External URL reference

SourceSKILL.md

29	\| MCP endpoint \| `https://xquik.com/mcp` (StreamableHTTP, same API key) \|

low line 42

External URL reference

SourceSKILL.md

42	const BASE = "https://xquik.com/api/v1";

low line 304

External URL reference

SourceSKILL.md

304	\| `tweetUrl` \| string \| Required. Full tweet URL: `https://x.com/user/status/ID` \|

low line 324

External URL reference

SourceSKILL.md

324	tweetUrl: "https://x.com/burakbayir/status/1893456789012345678",

low line 340

External URL reference

SourceSKILL.md

340	// tweetUrl: "https://x.com/burakbayir/status/1893456789012345678",

low line 448

External URL reference

SourceSKILL.md

448	url: "https://your-server.com/webhook",

low line 463

External URL reference

SourceSKILL.md

463	The MCP server at `https://xquik.com/mcp` uses a code-execution sandbox model with 2 tools (`explore` + `xquik`). The agent writes async JavaScript arrow functions that run in a sandboxed environment

low line 465

External URL reference

SourceSKILL.md

465	Legacy v1 server at `https://xquik.com/mcp/v1` exposes 18 discrete tools with traditional input schemas. All new integrations should use the default v2 server at `/mcp`.

Scanned on May 14, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2.0K

Rate this skill

Categorymarketing

UpdatedMay 20, 2026

openclaw api social-media-manager influencer-marketer marketing-analyst growth-marketer content-marketer telegram marketing

LeoYeAI/openclaw-master-skills