Safety-reviewed Agent Skill for using TweetClaw, the OpenClaw plugin for X and Twitter search, posting, follower export, media workflows, monitors, webhooks, and giveaway draws through Xquik.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
71
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
No reviewed flag detected in metadata.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 24/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
No review metadata found; increase manual validation.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Missing required evidence: Metadata review. Risk score 31.
Source repository/provenance is listed.
Required in this preset
Review metadata is missing.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required gaps: Metadata review
Decision timeline
Blocking gaps: Check metadata review status. Risk 28.
triage
Source/provenance metadata is available.
triage
Review metadata is missing.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
Blockers: Check metadata review status
Prerequisite readiness
4 prerequisites to line up before setup. Have accounts and credentials ready first.
Safety & privacy surface
3 safety and 3 privacy notes across 4 risk areas. Review closely: credentials & tokens, permissions & scopes, network access.
| Platform | Support | Install path |
|---|---|---|
| claude-code | Native | .claude/skills/<skill-name>/SKILL.md |
| codex | Native | .agents/skills/<skill-name>/SKILL.md |
| windsurf | Native | .windsurf/skills/<skill-name>/SKILL.md |
| gemini | Native | .gemini/skills/<skill-name>/SKILL.md or .agents/skills/<skill-name>/SKILL.md |
| cursor | Adapter | .cursor/rules/<skill-name>.mdc |
| cli | Manual | AGENTS.md or tool-specific context file |
# Trigger
"Use the TweetClaw skill to set up a safe X/Twitter automation workflow."
# Skill install
npx skills add xquik-dev/tweetclaw
# OpenClaw plugin install
openclaw plugins install npm:@xquik/tweetclawTweetClaw is the Agent Skill bundled with the @xquik/tweetclaw OpenClaw plugin. It gives agents a safety-first operating guide for X/Twitter workflows through Xquik: tweet search, reply search, user lookup, follower export, media upload and download, direct messages, monitors, webhooks, giveaway draws, and approval-gated posting.
Use the skill when an agent needs to install TweetClaw, decide which credential mode to use, verify OpenClaw runtime registration, or prepare a workflow that may touch public accounts, private account data, recurring monitors, or paid API calls.
Install the reusable Agent Skill:
npx skills add xquik-dev/tweetclaw
Install the OpenClaw plugin runtime from npm:
openclaw plugins install npm:@xquik/tweetclaw
Verify the runtime before live work:
openclaw plugins inspect tweetclaw --runtime --json
openclaw skills info tweetclaw
The runtime should show the read-only explore catalog tool, optional tweetclaw API tool, approval hook, and bundled status/trends command.
explore first to inspect available Xquik endpoints without credentials.explore and tweetclaw to OpenClaw tool allow settings only when the user wants agent-driven X/Twitter workflows.Show that TweetClaw OpenClaw X Automation Skill is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/skills/tweetclaw-openclaw-x-automation)TweetClaw OpenClaw X Automation Skill side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
2 trust signals differ across this comparison (Source provenance, Submitter).
| Field | Safety-reviewed Agent Skill for using TweetClaw, the OpenClaw plugin for X and Twitter search, posting, follower export, media workflows, monitors, webhooks, and giveaway draws through Xquik. Open dossier | Safety-reviewed Agent Skill for Hermes Tweet, the Hermes Agent plugin for X/Twitter endpoint discovery, credentialed reads, and approval-gated actions through Xquik. Open dossier | Expert reg-suit review skill for evaluating rendered UI image baselines, thresholds, snapshot storage, report artifacts, and visual QA release readiness. Open dossier | Expert Renovate review skill for evaluating dependency upgrade PRs, package rules, lockfile changes, grouping, automerge, and release readiness. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenanceDiffers | Source-backed | Source-backed | Submission linkedSource submission | Submission linkedSource submission |
| SubmitterDiffers | kriptoburak | kriptoburak | oktofeesh1 | oktofeesh1 |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | skills | skills | skills | skills |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | Xquik-dev | Xquik-dev | oktofeesh1 | oktofeesh1 |
| Added | 2026-06-09 | 2026-06-21 | 2026-06-03 | 2026-06-03 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓TweetClaw can perform public X account actions after OpenClaw tool opt-in and approval; review exact posts, replies, DMs, follows, media, monitors, webhooks, and draws before allowing a call. Keep `tweetclaw` as an optional OpenClaw tool and start with read-only `explore` until the user confirms the workflow. Do not use TweetClaw for spam, deceptive engagement, harassment, credential collection, impersonation, or bulk unsolicited outreach. | ✓Start with `tweet_explore` for credential-free planning before using credentialed tools. Treat `tweet_action` as approval-gated and review exact endpoint, method, and payload before any public or account-changing action. Do not use Hermes Tweet for spam, deceptive engagement, harassment, impersonation, credential collection, or bulk unsolicited outreach. | ✓Installing reg-suit adds npm packages to the selected project environment; pin the reviewed package version and avoid global installs for review work. reg-suit can publish image snapshots and HTML reports through storage plugins such as S3 or Google Cloud Storage; review destination configuration before running in shared CI. Visual baselines can normalize accidental UI changes if accepted too casually; require owner approval for broad layout, color, text, or viewport changes. The source ZIP is external and version-pinned for reference; package trust should remain a maintainer decision. | ✓Installing Renovate adds an npm package to the selected project environment; pin the reviewed version and avoid global installs for review work. Renovate can update dependency manifests and lockfiles; review generated diffs before approving automerge or grouped updates. Major upgrades, runtime dependencies, toolchain changes, and lockfile churn should be treated as release-blocking until tests and smoke checks pass. The source ZIP is external and version-pinned for reference; package trust should remain a maintainer decision. |
| Privacy notes | ✓Xquik API keys and MPP signing keys must stay in OpenClaw plugin config or environment variables, never in prompts, shared logs, PRs, or committed files. Tweet searches, timelines, DMs, bookmarks, follower exports, media metadata, monitors, webhook details, and account usage can expose private or account-scoped data. Use the Xquik dashboard and public docs for current billing, account, and data-handling details. | ✓Xquik API keys must stay in plugin config or environment variables, never in prompts, shared logs, issues, PRs, screenshots, or committed files. Credentialed reads can expose account-scoped timelines, searches, user data, or workflow context. Return concise summaries and source URLs without exposing raw private runtime logs or credentials. | ✓Rendered UI images and reports can expose environment URLs, branch names, visible UI text, test account data, and product screenshots. Storage and notification plugins can publish report links to CI systems, pull request comments, chat tools, or cloud buckets. Keep public review notes focused on changed components, thresholds, artifact links, and summarized findings; omit sensitive rendered content that does not need to be public. | ✓Dependency metadata can reveal package names, repository layout, branch names, internal registry hosts, and release cadence. Keep public review notes focused on package names, versions, config keys, and test results; omit operational details that do not need to be public. |
| Prerequisites |
|
|
|
|
| Install | | | | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Set autoMode.hard_deny rules to block risky actions in auto mode.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.