Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mateaix/mateclaw/x_intelnpx skills add mateaix/mateclaw --skill x_intelgit clone --depth 1 https://github.com/mateaix/mateclawWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00024 | $0.02740 |
| Opus 5 | $0.00012 | $0.01370 |
| Sonnet 5 | $0.00005 | $0.00548 |
| Haiku 4.5 | $0.00002 | $0.00274 |
Grade C, and why
x_intel scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 276 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x_intel — X (Twitter) information gathering
x_intel lets an agent pull posts, search results, timelines and user profiles from X (Twitter) through xurl, the X developer platform's official CLI. This skill is read-only by design — it intentionally omits posting, replying, deleting, DM-sending and any other write surface. For a separate publishing skill, see follow-up work.
Use this skill for:
- looking up a single post by ID or URL
- searching posts with the X search query syntax (
from:user,lang:en,#hashtag, ...) - reading the agent operator's home timeline, mentions, bookmarks, likes
- inspecting a user profile by handle
- walking the social graph (who someone follows / is followed by)
- raw read access to any X API v2 GET endpoint when the shortcuts don't fit
Credential safety (mandatory)
Critical rules when invoked inside an agent session:
- Never read, print, parse, summarize, upload or quote
~/.xurlinto chat context. It is a YAML token store. - Never ask the user to paste credentials/tokens into the conversation.
- Never suggest or run the auth commands with inline secrets in an agent session.
- Never pass
--verbose/-v— it prints auth headers to stdout. - The only credential-touching command this skill ever runs is
xurl auth status(status only, no secrets).
Forbidden flags in any agent-issued command (each accepts inline secrets):
--bearer-token, --consumer-key, --consumer-secret, --access-token, --token-secret, --client-id, --client-secret.
App registration and the OAuth 2.0 PKCE flow must be performed by the user outside the agent session (see "User setup" below). Tokens persist in ~/.xurl (YAML); OAuth 2.0 refreshes automatically.
Install
The agent should verify, not install. Direct the user to install if missing.
# Shell script (Linux + macOS, installs to ~/.local/bin, no sudo)
curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash
# Homebrew (macOS)
brew install --cask xdevplatform/tap/xurl
# Go (cross-platform)
go install github.com/xdevplatform/xurl@latest
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 276 lines · 24 tokens per session scan C 2fffd30a9e2d
x_intel is a skill published in the GitHub repository mateaix/mateclaw (1,061 stars, last pushed 2d ago), licensed Apache-2.0. It adds 24 tokens to every session and 2,740 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
twitter-cli
Use twitter-cli for ALL Twitter/X operations — reading tweets, posting, replying, quoting, liking, retweeting, following, searching, user lookups. Invoke whenever user requests any Twitter interaction.
hermes-tweet
Use Xquik in Hermes Agent for public X research, monitoring, thread summaries, creator discovery & approved actions. Not affiliated with X Corp. Use when the user requests X data or a named action. Trigger with "search X", "monitor X", "post tweet", or "X trends".
xquik
Xquik X data automation API - Use REST or MCP for tweet search, user lookup, follower exports, media downloads, monitors, webhooks, giveaway draws, and confirmation-gated X actions.
bots
Use when multi-platform bot automation hub — Telegram, Twitter/X, and WhatsApp bots for automated engagement, content distribution, and revenue generation.
twitter-agent
Build and run a Twitter/X agent with a distinct personality and automated workflows.
X Content Advisor
Use when a user asks how to grow or make better content on X/Twitter, wants an account or post audit, asks why a post underperformed, needs a weekly content plan, or wants a draft rewritten, a posting-time experiment, or a recommendation-risk review of sensitive media using evidence from their own timeline. Works with…