x-twitter-scraper
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is an API integration that restricts all network communication to verified first-party domains (xquik.com and docs.xquik.com) using HTTPS.
- [SAFE]: Implements a strict 'Principle of Least Privilege' by requiring explicit user approval for any operation that involves private data (DMs, bookmarks), account state changes (posting tweets, following users), or metered usage.
- [SAFE]: Proactively mitigates Indirect Prompt Injection (Category 8) by defining and enforcing the use of physical boundary markers (
XQUIK_UNTRUSTED_X_CONTENT) for any content retrieved from X (tweets, bios, DMs) and instructing the agent to treat such content as data only. - [SAFE]: The skill contains no executable code, shell commands, or local file system access. It relies entirely on standard platform tools like WebFetch to interact with the vendor's API.
- [SAFE]: Authentication is handled correctly via environment variables (XQUIK_API_KEY), with clear instructions to avoid exposing credentials in logs, prompts, or command-line arguments.
Audit Metadata