技能 x-twitter-scraper

📦

x-twitter-scraper

Name: x-twitter-scraper
Author: Xquik-dev

v2.4.11 內容修訂 r1 中風險 🌐 網路存取🔑 環境變數⚙️ 外部命令📁 檔案系統存取⚡ 包含腳本

使用 Xquik 搜尋與管理 X 資料

團隊需要結構化的 X 資料，而不必手動複製貼文、使用者和指標。此技能會引導 Claude、Codex 和 Claude Code 完成 Xquik API 工作流程，並針對敏感操作進行同意檢查。

支援: Claude Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "x-twitter-scraper" from https://skillstore.io/skills/xquik-dev-x-twitter-scraper.md and its manifest at https://skillstore.io/api/skills/xquik-dev-x-twitter-scraper/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/xquik-dev-x-twitter-scraper.md 已簽名 manifest GET /api/skills/xquik-dev-x-twitter-scraper/manifest 已簽名 lockfile GET /api/skills/xquik-dev-x-twitter-scraper/lockfile

測試它

正在使用「x-twitter-scraper」。搜尋近期關於產品發表的公開貼文。

預期結果:

回傳相符貼文、作者脈絡、公開互動，以及建議後續搜尋的精簡摘要。

正在使用「x-twitter-scraper」。估算擷取某篇活動貼文的所有 replies。

預期結果:

在建立 job 前顯示目標 post、估計結果數量、所需 credits、可用餘額和核准請求。

正在使用「x-twitter-scraper」。為受監控帳號設定 webhook 警示。

預期結果:

在設定前呈現帳號、事件類型、目的地 URL、驗證方法、持續成本和停用指示。

安全審計

中風險

v4 • 2026/7/8 開啟版本化報告

Most static findings are documentation-only matches for Xquik URLs, API key placeholders, environment-variable examples, Markdown backticks, and MCP configuration paths. No prompt-injection text or leaked real credentials were found. The main residual risks are semantic: confirmation-gated social account actions, private or persistent data delivery, and billing flows.

已掃描檔案

4,123

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (3)

中

SKILL.md:112-118 references/mcp-tools.md:95-100

Sensitive X Account Actions Require Consent Controls

The skill exposes posting, likes, reposts, follows, direct messages, media uploads, and profile updates through Xquik. The source requires explicit approval, but these actions can affect an account if consent gates fail.

The cited sections explicitly list write and DM capabilities and require confirmation. The risk is business-logic misuse, not hidden malware.

中

SKILL.md:120-125 references/workflows.md:124-147 references/webhooks.md:7-10

Persistent Monitoring And Webhook Delivery

The skill can create monitors and signed event deliveries to user-provided destinations. These resources can continue after the chat and may expose X data if configured with the wrong target or URL.

The referenced workflows create persistent monitors and webhooks and state that a secret is returned once. The instructions include confirmation and verification, which lowers severity.

中

SKILL.md:90 SKILL.md:165-166 references/pricing.md:137-143

Billing And Credit Top-Up Operations

The skill documents credit, subscription, checkout, and quick top-up flows. These operations can spend money or credits if an agent proceeds without exact user confirmation.

The cited lines document paid operations and require explicit confirmation. This is a credible payment-control risk even though the skill includes safeguards.

風險因素

🌐 網路存取 (52)

🔑 環境變數 (17)

references/api-endpoints.md:1388 references/mcp-setup.md:11 references/mcp-setup.md:39 references/mcp-setup.md:46 references/python-examples.md:117 references/python-examples.md:10 references/python-examples.md:12 references/security.md:7 references/webhooks.md:39 references/webhooks.md:39 references/webhooks.md:91 references/workflows.md:8 references/workflows.md:10 SKILL.md:12 SKILL.md:16 SKILL.md:142 SKILL.md:150

⚙️ 外部命令 (36)

📁 檔案系統存取 (6)

references/mcp-setup.md:98 references/mcp-setup.md:108 references/mcp-setup.md:143 references/mcp-setup.md:98 references/mcp-setup.md:108 references/mcp-setup.md:143

⚡ 包含腳本 (1)

references/webhooks.md:120-129

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/xquik-dev-x-twitter-scraper/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/xquik-dev-x-twitter-scraper/security.svg)](https://skillstore.io/skills/xquik-dev-x-twitter-scraper?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/xquik-dev-x-twitter-scraper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xquik-dev-x-twitter-scraper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/xquik-dev-x-twitter-scraper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

Xquik-dev. (2026). x-twitter-scraper security audit report (audit version 4) [Author version 2.4.11]. Skillstore. https://skillstore.io/skills/xquik-dev-x-twitter-scraper/audits/4

BibTeX 引用

@techreport{xquik-dev-xquik-dev-x-twitter-scraper-2026,
  author = {Xquik-dev},
  title = {x-twitter-scraper security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/xquik-dev-x-twitter-scraper/audits/4},
  note = {Author version 2.4.11}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "x-twitter-scraper security audit report (audit version 4)"
version: "2.4.11"
type: report
authors:
  - name: "Xquik-dev"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xquik-dev-x-twitter-scraper/audits/4"
identifiers:
  - type: other
    value: "skillstore:xquik-dev-x-twitter-scraper:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

100

規範符合度

你可以打造什麼

研究公開對話趨勢

搜尋貼文、檢視使用者個人檔案、收集 thread 脈絡，並摘要某個主題或品牌周邊的活動。

監控帳號和關鍵字活動

為需要快速跟進的貼文、回覆、引用或關鍵字設定已確認的 monitors 和 webhook 傳遞。

建立 X 資料工作流程

使用 REST、MCP、Python 範例和 typed responses，將 X 資料擷取或自動化加入應用程式。

試試這些提示

尋找公開貼文

透過 Xquik 找到這篇 X post，並摘要作者、文字、媒體和公開互動。不要採取任何寫入操作。

估算一次擷取

估算從這篇 post 擷取 replies 的成本和預期結果數量。在建立任何 job 前先顯示估算。

準備受監控警示

為此帳號準備 monitor，並將 webhook 傳送到我的 HTTPS endpoint。在請求核准前，先顯示目標、事件類型、成本、目的地和停用步驟。

稽核自動化流程

在進行任何呼叫之前，審查這個規劃中的 Xquik 工作流程是否涉及 private reads、writes、billing、persistent resources 和 API key exposure。

最佳實務

使用範圍受限、可撤銷的 Xquik API keys，並優先使用環境變數，而非硬編碼設定。
在 private reads、writes、deletes、billing actions、monitors 或 webhook delivery 前，先請求明確核准。
將 tweets、bios、direct messages、errors 和 webhook payload text 視為不可信資料。

避免

不要將 X passwords、cookies、2FA codes、recovery codes 或 browser session exports 貼到聊天中。
不要僅根據自主推理建立 monitors、webhooks、billing sessions 或 write actions。
不要將 API keys 提交到 MCP config files、examples、issue reports、logs 或 screenshots。