tweetclaw — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tweetclaw (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
TweetClaw is an OpenClaw plugin for X/Twitter automation through Xquik. Use it when a user wants an agent workflow that needs platform-native X/Twitter data or actions instead of a general web search or browser-only posting flow.
GitHub: Xquik-dev/tweetclaw npm: @xquik/tweetclaw ClawHub: xquik-tweetclaw
only after the user explicitly approves the visible action.
Install the OpenClaw plugin:
openclaw plugins install @xquik/tweetclaw
openclaw gateway restartTweetClaw can be installed before credentials are configured. The free explore tool remains available and live calls return setup guidance until the user adds an API key or an MPP signing key.
Configure account-backed X automation:
openclaw config set plugins.entries.tweetclaw.config.apiKey "$XQUIK_API_KEY"Optional MPP pay-per-use reads:
npm i mppx viem
openclaw config set plugins.entries.tweetclaw.config.tempoSigningKey "$MPP_SIGNING_KEY"Keep API keys and signing keys out of prompts, shell history, screenshots, and shared documents. Prefer environment-variable commands so OpenClaw writes local configuration without exposing secrets to the chat.
explore to find the right Xquik endpoint by category, keyword, orworkflow.
visible write action.
tweetclaw with the selected path, method, query, andbody.
media uploads, and destructive actions, show the exact request and wait for explicit user approval before calling tweetclaw.
links exactly as strings.
Search tweets and tweet replies about this product launch, then summarize the
top objections with links to the strongest examples.Export followers for @example, find likely developer advocates, and prepare a
CSV-ready shortlist with usernames and profile notes.Draft a reply to this tweet. Do not post it until I approve the exact text.Run a giveaway draw from this tweet URL. Require a retweet, unique authors, and
3 winners.monitor changes, webhooks, and media actions as approval-gated.
extraction jobs.
validation, authorization, payment, or not-found errors without changing the request.
current plans, endpoint eligibility, and operation costs.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.