xurl
Enables users to interact with the X/Twitter API via a CLI for posting, searching, and managing media and messages.
Install this skill
Security score
The xurl skill was audited on Jun 4, 2026 and we found 14 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Piping content to bash shell
| 59 | curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash |
Access to hidden dotfiles in home directory
| 39 | - **Never** read, print, parse, summarize, upload, or send `~/.xurl` to LLM context. |
Access to hidden dotfiles in home directory
| 41 | - The user must fill `~/.xurl` with secrets manually on their own machine. In Docker, this must be the `~` seen by Hermes tool subprocesses; see the Docker note below. |
Access to hidden dotfiles in home directory
| 49 | App credential registration and credential rotation must be done by the user manually, outside the agent session. After credentials are registered, the user authenticates with `xurl auth oauth2` — als |
Access to hidden dotfiles in home directory
| 58 | # Shell script (installs to ~/.local/bin, no sudo, works on Linux + macOS) |
Access to hidden dotfiles in home directory
| 118 | > **Docker HOME pitfall:** In the official Hermes Docker layout, `/opt/data` is `HERMES_HOME`, but Hermes tool subprocesses use `/opt/data/home` as `HOME`. That means `~/.xurl` resolves to `/opt/data/ |
Access to hidden dotfiles in home directory
| 397 | 7. Never paste `~/.xurl` contents back into the conversation. |
Access to hidden dotfiles in home directory
| 423 | - **Token storage:** `~/.xurl` is YAML. In Docker, use the Hermes subprocess HOME (`/opt/data/home` in the official image) so tokens land under `/opt/data/home/.xurl`. Never read or send this file to |
External URL reference
| 87 | 2. Set the redirect URI to `http://localhost:8080/callback` |
External URL reference
| 162 | - `POST_ID` accepts full URLs too (e.g. `https://x.com/user/status/1234567890`) — xurl extracts the ID. |
External URL reference
| 177 | xurl reply https://x.com/user/status/1234567890 "Agreed!" |
External URL reference
| 188 | xurl read https://x.com/user/status/1234567890 |
External URL reference
| 299 | xurl https://api.x.com/2/users/me |
External URL reference
| 354 | xurl read https://x.com/user/status/1234567890 |