Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add managedcode/dotnet-skills --skill xtwitter-scrapergit clone --depth 1 https://github.com/managedcode/dotnet-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/managedcode/dotnet-skills/xtwitter-scraper)<a href="https://agentmods.dev/skills/managedcode/dotnet-skills/xtwitter-scraper"><img src="https://agentmods.dev/badge/skills/managedcode/dotnet-skills/xtwitter-scraper/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/managedcode/dotnet-skills/xtwitter-scraper"><img src="https://agentmods.dev/badge/skills/managedcode/dotnet-skills/xtwitter-scraper.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 55 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 74 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.01298 |
| Opus 5.5 | $0.00060 | $0.00519 |
| Sonnet 5.5 | $0.00030 | $0.00260 |
| Haiku 4.5 | $0.00015 | $0.00130 |
Grade A, and why
xtwitter-scraper scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
XTwitterScraper
Trigger On
- adding the
XTwitterScraperNuGet package to a .NET application - searching tweets, reading tweet/user data, running extraction jobs, or monitoring X accounts through Xquik from .NET
- posting tweets, replies, likes, reposts, follows, or DMs through typed SDK methods
- exporting extraction results, handling raw responses, retries, rate limits, or API errors
- wiring Xquik webhook events into ASP.NET Core, workers, queues, or background processing
Workflow
-
Confirm the project actually needs Xquik API access from .NET. If it only needs prompt guidance, use a generic agent or API-design skill instead.
-
Install the NuGet package:
dotnet add package XTwitterScraper -
Configure credentials through environment or secret storage. Prefer
X_TWITTER_SCRAPER_API_KEY; keepX_TWITTER_SCRAPER_BASE_URLat its default unless a test fixture intentionally overrides it. -
Create
XTwitterScraperClientat the composition boundary and inject it or a narrow wrapper into application services. Do not scatter client construction across handlers. -
Build typed
Paramsobjects for SDK calls instead of manually concatenating query strings. -
Treat paginated responses, extraction jobs, binary exports, and webhook events as different flow types. Do not force them through one generic helper.
-
Preserve typed exceptions. Catch
XTwitterScraperRateLimitException, authorization errors, and 5xx errors only where the application can retry, defer, or show a useful state. -
Validate with unit tests around your wrapper and integration tests with configured API credentials only when the environment explicitly provides them.
Architecture
flowchart LR
A["ASP.NET Core or worker service"] --> B["Application wrapper"]
B --> C["XTwitterScraperClient"]
C --> D["Xquik REST API"]
D --> E["Typed response models"]
D --> F["Webhook events"]
D --> G["Binary exports"]
Core Knowledge
XTwitterScraperClientreadsX_TWITTER_SCRAPER_API_KEY,X_TWITTER_SCRAPER_BEARER_TOKEN, andX_TWITTER_SCRAPER_BASE_URLfrom the environment, and can also be configured manually.- The default API base URL is
https://xquik.com/api/v1. - Common read paths include tweet search, tweet detail, user search, user detail, profile tweets, followers, trends, monitors, and extraction jobs.
- Common write paths include tweet creation, replies, likes, reposts, follows, DMs, media upload, and giveaway draw actions.
- Request methods use typed
Paramsclasses, such asTweetSearchParams, and return typed response models such as paginated tweets. - Binary export methods return
HttpResponse; copy the stream deliberately instead of assuming JSON deserialization. - Raw response access is available through
WithRawResponsewhen code needs status, headers, or raw body inspection. WithOptionscan override client options for one call without mutating the original client or service.- The SDK retries selected transient failures by default. Do not add broad outer retry loops without checking idempotency and endpoint semantics.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 94 lines · 151 tokens per session scan A 095b70381450
xtwitter-scraper is a skill published in the GitHub repository managedcode/dotnet-skills (490 stars, last pushed today), licensed MIT. It adds 151 tokens to every session and 1,298 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
news-search
Search current news for a topic, company, competitor, or hook and return dated, attributed articles. Uses the newsjack CLI and Medialyst REST API when available, tries direct Medialyst MCP if the CLI is missing, and falls back to host web/browser search with explicit caveats only when neither cloud path is available.
channel-manager
Configure IM platform channels (Feishu, WeCom, Weixin, Discord, Telegram, DingTalk, QQ) for openclacky. Uses browser automation for navigation; guides the user to paste credentials and perform UI steps. Trigger on: "channel setup", "setup feishu", "setup wecom", "setup weixin", "setup wechat", "setup discord", "setup…
clean-architecture-dotnet
Use when domain logic leaks into API/Infrastructure, project references violate layer boundaries, or you need to decide between CQS (always), CQRS bus (complex domains), and DDD patterns (invariants and events).
generate-microcks-openapi-samples
Use when creating OpenAPI mock examples for Microcks, setting up request/response routing with dispatchers, or mapping request fields to mock responses.
nav-auth
Azure AD, TokenX, ID-porten, Maskinporten og JWT-validering for Nav-applikasjoner.
kafka
Rapids & Rivers, eventdrevet arkitektur, Kafka-mønstre og schema-design for Nav-applikasjoner.