x-twitter-scraper
Integrates with the X (Twitter) API via Xquik for tweet searches, user lookups, follower extraction, and account monitoring.
Install this skill
Security score
The x-twitter-scraper skill was audited on May 16, 2026 and we found 20 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 104 | const estimate = await fetch(`${BASE}/extractions/estimate`, { |
Template literal with variable interpolation in command context
| 116 | const job = await fetch(`${BASE}/extractions`, { |
Template literal with variable interpolation in command context
| 123 | const page = await fetch(`${BASE}/extractions/${job.id}`, { headers }).then(r => r.json()); |
Template literal with variable interpolation in command context
| 127 | const csvResponse = await fetch(`${BASE}/extractions/${job.id}/export?format=csv`, { headers }); |
Template literal with variable interpolation in command context
| 137 | const draw = await fetch(`${BASE}/draws`, { |
Template literal with variable interpolation in command context
| 152 | const details = await fetch(`${BASE}/draws/${draw.id}`, { headers }).then(r => r.json()); |
Template literal with variable interpolation in command context
| 172 | ```json |
Template literal with variable interpolation in command context
| 186 | > **Security note:** The `${XQUIK_API_KEY}` syntax requires your MCP client to support environment variable substitution. If it does not, replace it with your actual key at runtime — but never commit |
Webhook reference - potential data exfiltration
| 3 | description: "Use when the user wants to integrate with the X (Twitter) API via Xquik to search tweets, look up user profiles, extract followers, run giveaway draws, monitor accounts, or access trendi |
Webhook reference - potential data exfiltration
| 8 | You are an expert X (Twitter) data integration specialist. You help users build applications that interact with the X platform through the Xquik API, covering tweet search, user lookups, follower extr |
Webhook reference - potential data exfiltration
| 65 | | Receive events in real time | `POST /webhooks` | HMAC-signed delivery to your HTTPS endpoint | |
Webhook reference - potential data exfiltration
| 194 | - **Real-time alerts:** `POST /monitors` → `POST /webhooks` → test webhook delivery |
Access to .env file
| 47 | const API_KEY = process.env.XQUIK_API_KEY; |
External URL reference
| 20 | - Do you have an Xquik API key? If not, guide them to [xquik.com](https://xquik.com) to create one. |
External URL reference
| 34 | | **Base URL** | `https://xquik.com/api/v1` | |
External URL reference
| 36 | | **MCP endpoint** | `https://xquik.com/mcp` (StreamableHTTP, same API key) | |
External URL reference
| 48 | const BASE = "https://xquik.com/api/v1"; |
External URL reference
| 141 | tweetUrl: "https://x.com/user/status/1893456789012345678", |
External URL reference
| 177 | "url": "https://xquik.com/mcp", |
External URL reference
| 208 | - **Dashboard & API keys**: [xquik.com](https://xquik.com) |