x-twitter-connect
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs an external dependency,
@xquik/tweetclaw, from the npm registry to enable its core functionality. - [COMMAND_EXECUTION]: The skill instructs the agent to use the
openclawcommand-line tool for plugin installation and for setting the Xquik API key in the configuration. - [PROMPT_INJECTION]: The skill processes untrusted external data which introduces a risk of indirect prompt injection. Ingestion points: Public tweets, replies, and profile data from X/Twitter (SKILL.md). Boundary markers: Absent in prompt instructions. Capability inventory: Ability to post tweets, send DMs, and manage monitors via the
tweetclawtool. Sanitization: Mandatory user confirmation is required for all outgoing actions to mitigate potential malicious instructions in the data.
Audit Metadata