x-twitter-scraper

Enables efficient data extraction from X (Twitter) using a cost-effective API for monitoring and analysis.

Install this skill

or

0/100

Security score

The x-twitter-scraper skill was audited on Mar 30, 2026 and we found 52 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 367

Template literal with variable interpolation in command context

SourceSKILL.md

367	const response = await fetch(`${BASE}${path}`, {

medium line 377

Template literal with variable interpolation in command context

SourceSKILL.md

377	throw new Error(`Xquik API ${response.status}: ${error.error}`);

medium line 403

Template literal with variable interpolation in command context

SourceSKILL.md

403	const data = await xquikFetch(`${path}?${params}`);

medium line 481

Template literal with variable interpolation in command context

SourceSKILL.md

481	job = await xquikFetch(`/extractions/${job.id}`);

medium line 489

Template literal with variable interpolation in command context

SourceSKILL.md

489	const path = `/extractions/${job.id}${cursor ? `?after=${cursor}` : ""}`;

medium line 499

Template literal with variable interpolation in command context

SourceSKILL.md

499	const exportUrl = `${BASE}/extractions/${job.id}/export?format=csv`;

medium line 548

Template literal with variable interpolation in command context

SourceSKILL.md

548	const details = await xquikFetch(`/draws/${draw.id}`);

medium line 555

Template literal with variable interpolation in command context

SourceSKILL.md

555	const exportUrl = `${BASE}/draws/${draw.id}/export?format=csv`;

low line 452

Fetch to external URL

SourceSKILL.md

452	const estimate = await xquikFetch("/extractions/estimate", {

low line 468

Fetch to external URL

SourceSKILL.md

468	const job = await xquikFetch("/extractions", {

low line 531

Fetch to external URL

SourceSKILL.md

531	const draw = await xquikFetch("/draws", {

low line 623

Fetch to external URL

SourceSKILL.md

623	const monitor = await xquikFetch("/monitors", {

low line 632

Fetch to external URL

SourceSKILL.md

632	const webhook = await xquikFetch("/webhooks", {

low line 642

Fetch to external URL

SourceSKILL.md

642	const events = await xquikFetch("/events?monitorId=7&limit=50");

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: "X (Twitter) data platform skill for AI coding agents. 120 REST API endpoints, 2 MCP tools, HMAC webhooks. Tweet search, user lookup, follower extraction, write actions, monitoring, givea

medium line 20

Webhook reference - potential data exfiltration

SourceSKILL.md

20	Xquik is an X (Twitter) real-time data platform providing a REST API (120 endpoints), 2 MCP tools, and HMAC webhooks. It covers account monitoring, bulk data extraction (23 tools), giveaway draws, twe

medium line 121

Webhook reference - potential data exfiltration

SourceSKILL.md

121	Monitors, webhooks, integrations, account status, radar (7 sources), extraction/draw history, cost estimates, tweet composition (compose, refine, score), style cache management, drafts, support ticket

medium line 132

Webhook reference - potential data exfiltration

SourceSKILL.md

132	\| Monitoring + webhooks \| Free \| Not available \| Not available \|

low line 248

Webhook reference - potential data exfiltration

SourceSKILL.md

248	├─ Receive events via webhook → POST /webhooks

medium line 302

Webhook reference - potential data exfiltration

SourceSKILL.md

302	\| Receive events in real time \| `POST /webhooks` \| Free \|

medium line 303

Webhook reference - potential data exfiltration

SourceSKILL.md

303	\| Update webhook \| `PATCH /webhooks/{id}` \| Free \|

medium line 338

Webhook reference - potential data exfiltration

SourceSKILL.md

338	\| Trigger flow via webhook \| `POST /webhooks/inbound/{token}` \| Free \|

medium line 348

Webhook reference - potential data exfiltration

SourceSKILL.md

348	\| 400 \| `invalid_input`, `invalid_id`, `invalid_params`, `invalid_tweet_url`, `invalid_tweet_id`, `invalid_username`, `invalid_tool_type`, `invalid_format`, `missing_query`, `missing_params`, `webhook

medium line 558

Webhook reference - potential data exfiltration

SourceSKILL.md

558	## Webhook Event Handling

medium line 560

Webhook reference - potential data exfiltration

SourceSKILL.md

560	Webhooks deliver events to your HTTPS endpoint with HMAC-SHA256 signatures. Each delivery is a POST with `X-Xquik-Signature` header and JSON body containing `eventType`, `username`, and `data`.

medium line 562

Webhook reference - potential data exfiltration

SourceSKILL.md

562	### Webhook Handler (Express)

low line 568

Webhook reference - potential data exfiltration

SourceSKILL.md

568	const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;

low line 578

Webhook reference - potential data exfiltration

SourceSKILL.md

578	app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {

low line 583

Webhook reference - potential data exfiltration

SourceSKILL.md

583	if (!signature \|\| !verifySignature(payload, signature, WEBHOOK_SECRET)) {

medium line 605

Webhook reference - potential data exfiltration

SourceSKILL.md

605	For Flask (Python) webhook handler, see [references/python-examples.md](references/python-examples.md#webhook-handler-flask).

medium line 607

Webhook reference - potential data exfiltration

SourceSKILL.md

607	Webhook security rules:

medium line 612

Webhook reference - potential data exfiltration

SourceSKILL.md

612	- Store webhook secret in environment variables, never hardcode

medium line 615

Webhook reference - potential data exfiltration

SourceSKILL.md

615	Check delivery status via `GET /webhooks/{id}/deliveries` to monitor successful and failed attempts.

medium line 619

Webhook reference - potential data exfiltration

SourceSKILL.md

619	Complete end-to-end: create monitor, register webhook, handle events.

low line 631

Webhook reference - potential data exfiltration

SourceSKILL.md

631	// 2. Register webhook (free)

low line 632

Webhook reference - potential data exfiltration

SourceSKILL.md

632	const webhook = await xquikFetch("/webhooks", {

low line 635

Webhook reference - potential data exfiltration

SourceSKILL.md

635	url: "https://your-server.com/webhook",

low line 639

Webhook reference - potential data exfiltration

SourceSKILL.md

639	// IMPORTANT: Save webhook.secret. It is shown only once!

low line 641

Webhook reference - potential data exfiltration

SourceSKILL.md

641	// 3. Poll events (alternative to webhooks, free)

medium line 677

Webhook reference - potential data exfiltration

SourceSKILL.md

677	- Set up real-time alerts: `POST /monitors` → `POST /webhooks` → `POST /webhooks/{id}/test`

medium line 711

Webhook reference - potential data exfiltration

SourceSKILL.md

711	- `references/python-examples.md`: Python equivalents of all JavaScript examples (retry, extraction, draw, webhook)

medium line 712

Webhook reference - potential data exfiltration

SourceSKILL.md

712	- `references/webhooks.md`: Extended webhook examples, local testing with ngrok, delivery status monitoring

high line 712

Ngrok tunnel reference

SourceSKILL.md

712	- `references/webhooks.md`: Extended webhook examples, local testing with ngrok, delivery status monitoring

low line 568

Access to .env file

SourceSKILL.md

568	const WEBHOOK_SECRET = process.env.XQUIK_WEBHOOK_SECRET;

low line 4

External URL reference

SourceSKILL.md

4	compatibility: Requires internet access to call the Xquik REST API (https://xquik.com/api/v1)

low line 41

External URL reference

SourceSKILL.md

41	\| Base URL \| `https://xquik.com/api/v1` \|

low line 43

External URL reference

SourceSKILL.md

43	\| MCP endpoint \| `https://xquik.com/mcp` (StreamableHTTP, same API key) \|

low line 272

External URL reference

SourceSKILL.md

272	const BASE = "https://xquik.com/api/v1";

low line 514

External URL reference

SourceSKILL.md

514	\| `tweetUrl` \| string \| Required. Full tweet URL: `https://x.com/user/status/ID` \|

low line 534

External URL reference

SourceSKILL.md

534	tweetUrl: "https://x.com/burakbayir/status/1893456789012345678",

low line 635

External URL reference

SourceSKILL.md

635	url: "https://your-server.com/webhook",

low line 649

External URL reference

SourceSKILL.md

649	The MCP server at `https://xquik.com/mcp` provides 2 tools. StreamableHTTP transport. API key auth (`x-api-key` header) for CLI/IDE clients; OAuth 2.1 for web clients (Claude.ai, ChatGPT Developer Mod

Scanned on Mar 30, 2026

View Security Dashboard

Installation guide →

GitHub Stars 27

Rate this skill

Categorymarketing

UpdatedApril 10, 2026

openclaw api marketing-analyst social-media-manager influencer-marketer growth-marketer content-marketer marketing

Xquik-dev/x-twitter-scraper