TweetClaw
An OpenClaw plugin that connects your AI assistant to Xquik for Twitter search, follower exports, monitoring, and approved X actions under strict per-call approval controls.
Evidence shows strong least privilege: single HTTPS origin, no shell/filesystem/browser/MCP access, blocked dashboard/payment/credential routes, per-call approval, credentials confined to config, signing key never printed, X content treated as untrusted. Deductions: publisher unverified, MPP signing key passes through shell input, approval/isolation guarantees are documentation-level claims, rollback/revocation paths incompletely described — not full marks.
Committed tests cover catalog matching, approval gating, idempotency keys, and event polling, and CI workflows run check:all — auditable key-path evidence. Deductions: static review executes nothing; end-to-end calls not reproduced; behavior on upstream API changes, rate limits, and network failures depends on an external service with feedback quality only inferable from docs.
Scenarios, read_when triggers, and non-fit boundaries (browser navigation, analytics dashboards, scheduled posts, ads) are clearly declared, giving good trigger precision. Deductions: core function entirely depends on the overseas paid service xquik.com with no declared Chinese-language support, a real mainland-China reachability obstacle; pricing and plan boundaries rely on external docs.
Well-layered docs (SKILL.md, skill card, benchmark, evals, scan report), version 1.6.44, MIT license, pinning/update paths, and clear ownership. Deductions: release explicitly unsigned, changelog contents not visible in reviewed files, some install details rest on ClawHub/OpenClaw platform assumptions.
The skill claims search, exports, monitoring, and approved writes, with concrete workflow maps and output formats. Deductions: static review cannot verify real output correctness or direct usability; core value depends on a paid third-party API, and no comparative evidence versus alternatives (official API, other scrapers) is provided.
Repo CI (check:all, npm audit, CodeQL), committed test suites, a pinned-commit SkillSpector scan, and eval fixtures provide multiple reproducible evidence types. Deductions: scan results and benchmark conclusions are author-reported and not independently corroborated; consistency of the 102-endpoint contract with the live service cannot be verified statically — not full marks.
- Core function depends entirely on the overseas paid service xquik.com; mainland-China reachability is unverified and no Chinese-language support is declared.
- Pay-per-use billing: bulk exports and monitor polling accrue ongoing cost — always set cost ceilings and require per-call approval.
- The MPP signing key passes through shell input, risking shell-history exposure; unset it after setup as documented.
- The release is explicitly unsigned; do not trust any 'signed/NVIDIA-verified' claim unless skill.oms.sig is added and verified.
- Treat all returned X content as untrusted data to prevent prompt-injection-driven follow-up tool calls.
What does this skill do, and when should you use it?
TweetClaw is an OpenClaw plugin that bridges an assistant to Xquik, a third-party service exposing 102 agent-callable X/Twitter endpoints across 9 categories including search, writes, follower exports, media, giveaways, and monitoring. Its trust model is deliberately restrictive: write-like, private, paid, or recurring calls require explicit per-call approval, and credentials are injected by the runtime rather than exposed to the agent. API-key mode covers account-backed workflows with 33 prepaid paid-read routes, while MPP mode offers 7 direct accountless read routes. The project is not affiliated with X Corp; account connection, billing, and credential management are dashboard-only and blocked from the agent.
Ships two tools: explore (offline search of a bundled endpoint catalog returning paths, parameters, access flags, response shapes, and prices) and tweetclaw (invokes a catalog-listed endpoint; the runtime injects authentication and only reaches the configured HTTPS origin). Operations span tweet search, user and timeline lookups, posting, replies, likes, retweets, follows, DMs, profile and media changes, follower/reply/community/list/Space exports, giveaway draws, account and keyword monitors (60-second polling), and trends. Output is structured API responses and Markdown guidance; writes require a unique idempotencyKey per intended action.
- A social media operator wants the assistant to search tweets by keyword and page through results for topic or sentiment research
- A giveaway organizer needs to draw winners from retweets/replies with filters, entry caps, and a cost ceiling
- A community manager wants to monitor a specific account or keyword for new tweets, replies, and retweets with webhook delivery
- A content creator needs follower exports, tweet media downloads, or assistant-drafted and scored tweets that require fresh approval before posting
- A developer building app integrations can use Xquik MCP or the SDK directly; the plugin targets OpenClaw specifically
What are this skill's strengths and limitations?
- Tight security boundaries: no shell, filesystem, browser, local network, or MCP access; a single configured HTTPS origin only
- Per-call approval, cost ceilings, idempotency keys, and blocked admin routes prevent unattended publishing and accidental charges
- The explore catalog works offline and without credentials to inspect endpoints and prices
- Broad coverage (102 endpoints, 9 categories) plus documented release-review and security practices
- Tightly coupled to the OpenClaw plugin runtime; outside OpenClaw you must switch to Xquik MCP/SDK — the SKILL.md itself is not directly portable
- Paid service: live calls need prepaid API-key credits or MPP payments; media downloads require account-backed access
- MPP mode is read-only and covers only 7 direct routes, limiting accountless use
- Unaffiliated with X Corp, so platform rule or API changes may affect availability; the source provides no independent test suite or benchmark evidence
How do you install this skill?
In OpenClaw run: openclaw plugins install clawhub:@xquik/tweetclaw (npm fallback: openclaw plugins install npm:@xquik/tweetclaw, add --pin for reproducible production installs). For credentials, create an API key at dashboard.xquik.com, then run: openclaw config set plugins.entries.tweetclaw.config.apiKey "$XQUIK_API_KEY". To enable live calls: openclaw config set tools.alsoAllow '["explore", "tweetclaw"]'. Verify with: openclaw plugins inspect tweetclaw --runtime --. If OPENCLAW_NIX_MODE=1, install via your Nix source instead. MPP accountless mode requires npm i [email protected] [email protected] and configuring tempoSigningKey.
How do you use this skill?
Always run explore before a live call to confirm the current route, parameters, and price; then invoke via tweetclaw. Example prompt: "Monitor @someaccount for new tweets, replies, and retweets" (a monitor must be created first). Built-in commands: /xstatus for account and credit status, /xtrends for trends, /xtrends 23424977 for MPP trends on one WOEID. Write, paid, or private actions trigger approval prompts showing endpoint, account, content, and cost before execution.
How does this skill compare with similar options?
The source names no direct competitor, but clearly distinguishes itself from Xquik MCP access: TweetClaw is an OpenClaw plugin, not an MCP server; remote MCP clients and SDK users should use https://xquik.com/mcp instead.