Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/aiocean/claude-plugins/aio-xnpx skills add aiocean/claude-plugins --skill aio-xgit clone --depth 1 https://github.com/aiocean/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aiocean/claude-plugins/aio-x)<a href="https://agentmods.dev/skills/aiocean/claude-plugins/aio-x"><img src="https://agentmods.dev/badge/skills/aiocean/claude-plugins/aio-x.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01355 |
| Opus 5 | $0.00032 | $0.00678 |
| Sonnet 5 | $0.00013 | $0.00271 |
| Haiku 4.5 | $0.00006 | $0.00136 |
Grade B, and why
aio-x scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- MCP configured: !`cat .mcp.json 2>/dev/null | grep -q '"x"' && echo "YES" || echo "NO"` How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
X / Twitter Skill
Twitter/X operations via nguyenvanduocit/x-mcp.
Environment
- Go: !
which go 2>/dev/null || echo "NOT INSTALLED" - x-mcp: !
which x-mcp 2>/dev/null || echo "NOT INSTALLED" - x-cli: !
which x-cli 2>/dev/null || echo "NOT INSTALLED" - X_API_KEY: !
[ -n "$X_API_KEY" ] && echo "SET" || echo "NOT SET" - X_API_SECRET: !
[ -n "$X_API_SECRET" ] && echo "SET" || echo "NOT SET" - X_ACCESS_TOKEN: !
[ -n "$X_ACCESS_TOKEN" ] && echo "SET" || echo "NOT SET" - X_ACCESS_TOKEN_SECRET: !
[ -n "$X_ACCESS_TOKEN_SECRET" ] && echo "SET" || echo "NOT SET" - MCP configured: !
cat .mcp.json 2>/dev/null | grep -q '"x"' && echo "YES" || echo "NO"
Install (skip if already installed above)
go install github.com/nguyenvanduocit/x-mcp@latest
go install github.com/nguyenvanduocit/x-mcp/cmd/x-cli@latest
Add to .mcp.json:
{
"mcpServers": {
"x": {
"command": "x-mcp",
"env": {
"X_API_KEY": "your-api-key",
"X_API_SECRET": "your-api-secret",
"X_ACCESS_TOKEN": "your-access-token",
"X_ACCESS_TOKEN_SECRET": "your-access-token-secret"
}
}
}
}
All four values from https://developer.x.com/en/portal/dashboard. Restart Claude Code after configuring.
MCP Tools (prefix: x_)
Tweet Operations
| Tool | Usage |
|---|---|
x_get_tweet |
(tweet_id: "1234567890") |
x_post_tweet |
(text: "Hello from Claude!") |
x_delete_tweet |
(tweet_id: "1234567890") |
x_post_thread |
(tweets: ["First", "Second", "Final"]) |
x_search |
(query: "golang best practices", max_results: 10) |
User Operations
| Tool | Usage |
|---|---|
x_get_user |
(username: "elonmusk") |
x_get_user_timeline |
(user_id: "123456", max_results: 20) |
x_get_mentions |
(user_id: "123456", max_results: 20) |
Engagement
x_like_tweet(tweet_id: "1234567890")
x_unlike_tweet(tweet_id: "1234567890")
x_retweet(tweet_id: "1234567890")
x_unretweet(tweet_id: "1234567890")
x_get_quote_tweets(tweet_id: "1234567890")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 135 lines · 63 tokens per session scan B 0da9b84c3cef
aio-x is a skill published in the GitHub repository aiocean/claude-plugins (4 stars, last pushed 4d ago), licensed MIT. It adds 63 tokens to every session and 1,355 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
design-patterns
Detect, suggest, and evaluate GoF design patterns in TypeScript/JavaScript codebases. Use when refactoring code, applying singleton/factory/observer/strategy patterns, reviewing pattern quality, or finding stack-native alternatives for React, Angular, NestJS, and Vue.
source-command-audit-whitepapers
Audit version freshness, FR/EN parity, and metadata quality of all whitepapers and recap cards.
audit-agents-skills
Audit Claude Code agents, skills, and commands for quality and production readiness. Use when evaluating skill quality, checking production readiness scores, or comparing agents against best-practice templates.
check-cache-bugs
Audit Claude Code setup for cache bugs (CC#40524): sentinel, --resume/--continue, attribution header + ArkNill B3/B4/B5.
issue-triage
3-phase issue backlog management with audit, deep analysis, and validated triage actions. Use when triaging GitHub issues, sorting bug reports, cleaning up stale tickets, or detecting duplicate issues. Args: 'all' to analyze all, issue numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit only.
self-assessment
Interactive skill assessment with personalized learning path generation.