Tweetsmash Api

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 118e61cf1c61 · 16 Oct 2026Report an issue or request a re-scan

• Publisherpedronauck GitHub userOwner of the repository this skill is read from
• Source folderpedronauck/skills/skills/mine/tweetsmash-apiThe exact folder we audited
• LicenceNot declaredAs the repository states it
• Commit pinned for this verdict118e61cf1c61A new audit runs when the source changes
• Repository statusNot archivedLast push 31 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Integrate TweetSmash REST bookmark retrieval, filtering, pagination, and label management into scripts or tools. Excludes browser automation, other Twitter/X APIs, and marketing copy.

---
name: tweetsmash-api
description: "Integrate TweetSmash REST bookmark retrieval, filtering, pagination, and label management into scripts or tools. Excludes browser automation, other Twitter/X APIs, and marketing copy."
metadata:
  author: Pedro Nauck
  github: https://github.com/pedronauck
  repository: https://github.com/pedronauck/skills
---
# TweetSmash API

Use this skill to work directly with the TweetSmash REST API using current endpoint evidence. Reuse documentation already verified in this task; refresh it when missing, stale, or contradicted by the API. Read `references/api-reference.md` before choosing an endpoint. Read `references/bookmarks-filters.md` only when bookmark filtering is required.

## Procedures

**Step 1: Validate Credentials and Scope**
1. Confirm that a TweetSmash API key is available before making requests. Prefer `TWEETSMASH_API_KEY` in the shell environment.
2. Read `references/api-reference.md` to confirm the current endpoint, required headers, rate limits, and status codes.
3. If the task requires bookmark filtering or pagination, read `references/bookmarks-filters.md`.

**Step 2: Build the Request**
1. Use `Authorization: Bearer $TWEETSMASH_API_KEY` on every request.
2. Use `Content-Type: application/json` for all examples in this skill. Keep the base URL as `https://api.tweetsmash.com/v1`.
3. If the task fetches bookmarks with filters, execute `python3 <tweetsmash-api-dir>/scripts/build-bookmarks-url.py` with the needed flags to generate a correctly encoded URL.
4. If the task adds labels, start from `assets/add-labels-body.json` and fill in `tweet_ids` plus either `label_id` or `label_name`.
5. If the task removes labels, start from `assets/remove-labels-body.json` and fill in `tweet_ids` plus `label_name`.

**Step 3: Execute the Correct Endpoint**
1. Fetch bookmarks with `GET /bookmarks`. Use the URL from `scripts/build-bookmarks-url.py` when filters, search, or cursors are present.
2. List labels with `GET /labels` when the task needs current label IDs, label names, or usage counts.
3. Add labels with `POST /labels/add` when the task needs to organize one or more bookmarked tweets.
4. Remove labels with `POST /labels/remove` when the task needs to clean up or reclassify bookmarked tweets.
5. Use cURL for quick execution or translate the same request into the caller’s runtime only after the endpoint and payload are confirmed.

**Step 4: Verify the Response**
1. Confirm that the response JSON contains `"status": true` before reporting success.
2. For bookmark reads, inspect `meta.next_cursor`, `meta.limit`, and `meta.total_count` when pagination matters.
3. For label mutations, confirm the success message matches the intended action.
4. If the task depends on label existence and the mutation response does not establish it, call `GET /labels` to verify the resulting state.

**Step 5: Return a Usable Result**
1. Summarize the request method, endpoint, and effective filters or payload fields that were used.
2. Return the response body or a structured summary, depending on the caller’s requested output format.
3. If follow-up pagination is possible, expose `meta.next_cursor` so the next request can continue from the prior page.

## Error Handling

* If authentication fails with `401`, confirm that the bearer token is present, non-empty, and taken from the correct TweetSmash account.
* If the API returns `402`, stop and report that the current plan does not permit the requested API access.
* If the API returns `429`, stop issuing requests and honor `Retry-After` or current rate-limit headers. The bundled reference records a historical limit; do not treat it as universal or retry in a tight loop.
* If a bookmark query becomes hard to assemble by hand, rerun `python3 <tweetsmash-api-dir>/scripts/build-bookmarks-url.py --help` and rebuild the URL instead of manually concatenating query strings.
* If a label mutation is ambiguous, list labels first with `GET /labels` and then rerun the mutation using the confirmed label identifier or label name.

Excerpt, first 4,050 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-16
   ✓SAFE B 89 / 100

   first audit · source 118e61cf1c61

Questions about Tweetsmash Api

• github.com/pedronauck/skills/tree/main/skills/mine/tweetsmash-ap — the audited source at commit 118e61cf1c61 and every finding aboveObserved · 16 Oct 2026

Spotted something wrong? Report a correction · Methodology