Agent skill · Audited from source

x-tweet-fetcher

skill · ythx-101/x-tweet-fetcherMIT licenceAudited 21 Oct 2026 · source bf9a3c9c4f4b

★ 988pushed 6 days ago
✓SAFEGrade B · 89/100 · 21 Oct 2026 · bf9a3c9
988repo stars · whole ythx-101/x-tweet-fetcher

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit bf9a3c9c4f4b and observed network access and no hard-coded secrets. What it does: Fetch tweets, replies, timelines, search results, X Lists, and X Articles from X/Twitter without login or API keys. Single tweets: zero dependencies (FxTwitter). Timelines/search/replies: a Nitter instance (XTF_NITTER).…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “x-tweet-fetcher (ythx-101/x-tweet-fetcher)”. Retrieved 21 Oct 2026. https://modelsatlas.com/skills/ythx-101/x-tweet-fetcher

Trust audit

Audit 0.4.1 · source read 21 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium6 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared6 observations
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS6
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (6)

LOWNetwork egressnet.raw_ip · MIGRATION.md:18
F-04 Network egressCWE-200 · CWE-319Layer L1
1. **No more hardcoded public Nitter default for browser mode.** v1 defaulted `--nitter` to `nitter.tiekoetter.com`, which contradicted the README's own advice. v2 defaults to your `XTF_NITTER` config
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:42
F-04 Network egressCWE-200 · CWE-319Layer L1
export XTF_NITTER=http://127.0.0.1:8788
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:140
F-04 Network egressCWE-200 · CWE-319Layer L1
| `XTF_NITTER` | `http://127.0.0.1:8788` | Comma-separated Nitter instances, tried in order with failover |
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:155
F-04 Network egressCWE-200 · CWE-319Layer L1
export XTF_NITTER=http://127.0.0.1:8788
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:161
F-04 Network egressCWE-200 · CWE-319Layer L1
export XTF_NITTER=http://127.0.0.1:8788,https://your-backup-instance.example
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · tests/fixtures/nitter_status.html:1101
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
<div class="show-more"><a href="?cursor=DAAKCgABHMetRvu__qkLAAIAAAGcRW1QQzZ3QUFBZlEvZ0dKTjB2R3AvQUFBQUNRY3NaU3BSWmNBWFJwcE1Ya1JHNUVuSEQ5Z3QvcFdZTW9ZazNYMWhCYlJFaHg3SFg3YjJxRmdIRDdtRnkrYk1XTUo0TGxVeWhT
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha bf9a3c9c4f4b · 21 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherythx-101 GitHub userOwner of the repository this skill is read from
  • Source folderythx-101/x-tweet-fetcherThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdictbf9a3c9c4f4bA new audit runs when the source changes
  • Repository statusNot archivedLast push 6 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Fetch tweets, replies, timelines, search results, X Lists, and X Articles from X/Twitter without login or API keys. Single tweets: zero dependencies (FxTwitter). Timelines/search/replies: a Nitter instance (XTF_NITTER).…

---
name: x-tweet-fetcher
description: >
  Fetch tweets, replies, timelines, search results, X Lists, and X Articles
  from X/Twitter without login or API keys. Single tweets: zero dependencies
  (FxTwitter). Timelines/search/replies: a Nitter instance (XTF_NITTER).
  Lists/Articles: a browser driver (Camofox or Playwright). Unified JSON
  schema across all backends; machine-readable error_code for agent branching.
  Field reports and agent-use questions: Agent Waystation #22 Teahouse:
  https://github.com/ythx-101/openclaw-qa/discussions/22
---

# X Tweet Fetcher

Fetch tweets from X/Twitter without authentication. For agent-use stories, failures, and field reports, start from **[#22 Teahouse / 茶座](https://github.com/ythx-101/openclaw-qa/discussions/22)**.

## Feature Overview

| Feature | Command | Dependencies |
|---------|---------|-------------|
| Single tweet | `xtf --url <tweet_url>` | None (zero deps) |
| Reply threads | `xtf --url <tweet_url> --replies` | Nitter or browser |
| User timeline | `xtf --user <username> --limit 50` | Nitter or browser |
| Search | `xtf --search "<query>"` | Nitter |
| User profile | `xtf --user-info <username>` | None (zero deps) |
| X List | `xtf --list <list_url_or_id>` | Browser (Camofox/Playwright) |
| X Article | `xtf --article <url_or_id>` | Browser (Camofox/Playwright) |
| Mentions monitor | `xtf --monitor @<username>` | Nitter or browser |

`python3 scripts/fetch_tweet.py` accepts the same flags (v1-compatible entry point).

## Basic Usage (Zero Dependencies)

```bash
# JSON output (default)
xtf --url https://x.com/user/status/1234567890

# Human-readable
xtf --url https://x.com/user/status/1234567890 --text-only

# Output covers: text, author, stats (likes/retweets/views), media URLs,
# quoted tweets, and full article text for tweet-embedded articles.
```

## Timeline / Search / Replies (Nitter)

```bash
export XTF_NITTER=http://127.0.0.1:8788   # your instance; comma-separate for failover
xtf --user elonmusk --limit 20
xtf --search "openclaw" --limit 10
xtf --url https://x.com/user/status/123 --replies
```

Backend selection: `--backend auto` (default, Nitter first then browser), `--backend nitter`, `--backend browser`.

## Lists & Articles (Browser)

```bash
# Camofox running on localhost:9377 (default), or:
export XTF_BROWSER=playwright

xtf --list https://x.com/i/lists/1455045069516357634 --limit 30
xtf --article https://x.com/i/article/2011779830157557760
```

Note: full X Article text requires X login; without it you get title + public preview (`is_partial: true`).

## Mentions Monitor (cron-friendly)

```bash
xtf --monitor @yourhandle
# exit 0 = no new mentions, 1 = new mentions found, 2 = setup error
# First run builds a baseline silently; later runs report only new URLs.
```

## Error Handling for Agents

Every error result includes `error` (message) and `error_code`:
`invalid_input` · `not_found` · `rate_limited` · `upstream_down` · `backend_unavailable` · `all_backends_failed` (with per-backend `error_causes`).

## Python API

```python
from xtf import Router
router = Router()
tweets = router.fetch_timeline("elonmusk", limit=20)  # list[Tweet]
print(tweets[0].to_dict())
```

## Directory Structure

```
src/xtf/
├── backends/   # fxtwitter.py, nitter.py, browser.py
├── parsers/    # pure parsing functions, fixture-tested
├── router.py   # auto-fallback
├── monitor.py  # mentions monitor
└── cli.py      # the `xtf` command
scripts/fetch_tweet.py  # v1-compatible shim
```

Looking for Chinese-platform fetching (Weibo/Bilibili/WeChat) or tweet growth tracking? Those moved out of this repo in v2 — see MIGRATION.md.

Excerpt, first 3,633 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit bf9a3c9

Download folder ↗
git clone https://github.com/ythx-101/x-tweet-fetcher
pip install ".[playwright]"            # from the clone
pip install -e ".[dev]"

Commands as the repository documents them: shown, never run by us. Our verdict covers commit bf9a3c9c4f4b only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source bf9a3c9c4f4b

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/ythx-101/x-tweet-fetcher/badge.svg)](https://modelsatlas.com/skills/ythx-101/x-tweet-fetcher/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/ythx-101/x-tweet-fetcher/badge.svg)](https://modelsatlas.com/skills/ythx-101/x-tweet-fetcher/)

Questions about x-tweet-fetcher

What does the x-tweet-fetcher skill do?
Fetch X/Twitter tweets, replies, timelines, and articles without login or API keys — field tool for AI agents.
Is x-tweet-fetcher safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can x-tweet-fetcher access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does x-tweet-fetcher work with?
Its documentation mentions codex, cursor and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (bf9a3c9c4f4b), read on 2026-10-21. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.