Real-time X/Twitter search powered by Grok-4. Find tweets, trends, and discussions with citations. Grok-4.20 also returns image results alongside tweet citat...
Security Analysis
high confidenceThe skill's code, instructions, and required credential (XAI_API_KEY) align with its stated purpose of performing real-time X/Twitter searches via xAI's Responses API; nothing requested or installed is disproportionate or unrelated.
Name/description claim real-time X search via Grok/xAI and the package only asks for an xAI API key and optionally reads a local clawdbot config for the same key. The code calls api.x.ai/v1/responses with an x_search tool payload — consistent with the stated purpose.
SKILL.md instructs running the bundled Node script and setting XAI_API_KEY (or the clawdbot config) which the script uses. A static scan flagged a 'system-prompt-override' pattern; this skill intentionally constructs a system prompt (payload.input) for the x_search tool when calling the Responses API, which explains the finding. There is no instruction to read unrelated files or to transmit data to endpoints other than api.x.ai.
No install spec; the skill is instruction-only plus a small local JS script. There are no downloads from untrusted URLs, no extract operations, and no package installs performed by the skill at runtime.
Only XAI_API_KEY is required (declared as primary). The script also respects optional SEARCH_X_MODEL and SEARCH_X_DAYS. It will attempt to read ~/.clawdbot/clawdbot.json to find a stored apiKey as a convenience fallback — this is consistent with its purpose but means it will read that config file if present.
The skill does not request permanent inclusion (always=false), does not modify other skills or system-wide settings, and does not write persistent data. It only reads a local config file if present.
Guidance
This skill appears to do what it claims: it uses your xAI API key to query api.x.ai for X/Twitter results. Before installing: 1) Only provide an XAI_API_KEY you trust and that has appropriate permissions. 2) If you have a ~/.clawdbot/clawdbot.json file, the script will read it to try to find an API key — remove sensitive keys if you don't want them reused. 3) Review the script (scripts/search.js) yourself if you have concerns; it only makes HTTPS requests to api.x.ai and prints results. 4) If you plan to run this in a sensitive environment, consider running it in an isolated container or environment to limit exposure of any local config files.
Latest Release
v1.2.1
Fix display name (remove Clawdbot prefix)
More by @mvanhorn
Published by @mvanhorn on ClawHub
