Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tdimino/claude-code-minoan --skill twittergit clone --depth 1 https://github.com/tdimino/claude-code-minoanWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tdimino/claude-code-minoan/twitter)<a href="https://agentmods.dev/skills/tdimino/claude-code-minoan/twitter"><img src="https://agentmods.dev/badge/skills/tdimino/claude-code-minoan/twitter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tdimino/claude-code-minoan/twitter"><img src="https://agentmods.dev/badge/skills/tdimino/claude-code-minoan/twitter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 8 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 174 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- medium Data Exfiltration · line 40 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 42 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium MCP Rug Pull · line 182 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 183 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 184 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 185 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 186 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00190 | $0.03064 |
| Opus 5 | $0.00095 | $0.01532 |
| Sonnet 5 | $0.00038 | $0.00613 |
| Haiku 4.5 | $0.00019 | $0.00306 |
Grade A, and why
twitter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Twitter/X — Multi-Mode Integration
Five tools; choose by task:
| Mode | Tool | Auth | Cost | Use For |
|---|---|---|---|---|
| Hosted MCP | xapi MCP server (via xurl bridge) |
OAuth 2.0 | pay-per-use | Full-archive search, trends, bookmarks, Articles, timelines |
| Official API | x-search |
Bearer + OAuth 1.0a | pay-per-use, tracked | Cost-governed research, feeds, watchlists, posting |
| Official CLI | xurl |
OAuth 1.0a + 2.0 | pay-per-use | Any endpoint: media upload, DMs, raw API calls |
| Session | bird |
Browser cookies | Free | Casual reads, mentions, media posts — while it lasts |
| Archival | smaug |
Via bird | Free | Bookmark/likes processing, AI-powered filing |
Pricing changes often (twice in 2026 already) — full rate card and billing mechanics in references/pricing.md. Headline numbers: post read $0.005, post create $0.015, post with URL $0.200, owned reads $0.001, 24h-UTC dedup, 2M reads/month cap.
When to Use Which
| Task | Tool | Why |
|---|---|---|
| Full-archive search (beyond 7 days) | xapi MCP | Only mode that reaches X's full history |
| Trends, news by location | xapi MCP | X-proprietary, not in x-search |
| Gauge tweet volume before reading | x-search counts | $0.005 flat vs $0.005/tweet for reads |
| Search recent tweets by topic | x-search | Cost-tracked, cached, quality filters |
| Broad topic, multiple phrasings | x-search multi | Fan out expanded variants, dedup merge |
| Read a single tweet from a URL | jina URL |
Free; the one scraper that works on X |
| Daily feed from followed accounts | x-search feed | Batched OR-queries, cheap |
| Monitor specific accounts | x-search watchlist | Batch check with cost tracking |
| Post a text tweet or reply | x-search post/reply | URL-surcharge guard built in |
| Post with media, DMs, Articles | xurl | Official CLI, chunked upload |
| Check actual billed spend | x-search usage | GET /2/usage/tweets ground truth |
| Free casual reads / mentions | bird | Free while cookies + GraphQL hold |
| Archive bookmarks | smaug | AI categorization, markdown output |
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- codex-agent-guide.md 2.7 KB
- README.md 6.2 KB
- references/pricing.md 2.7 KB
- references/query-expansion.md 3.3 KB
- references/setup.md 2.0 KB
- references/xurl-mcp-setup.md 3.2 KB
- x-search/data/feedgroups.json 3.3 KB
- x-search/data/watchlist.json 240 B
- x-search/lib/api.ts 16 KB runs code
- x-search/lib/cache.ts 2.3 KB runs code
- x-search/lib/format.ts 7.6 KB runs code
- x-search/x-search.ts 45 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 204 lines · 190 tokens per session scan A 6f820bcb014a
twitter is a skill published in the GitHub repository tdimino/claude-code-minoan (41 stars, last pushed yesterday), licensed MIT. It adds 190 tokens to every session and 3,064 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
manager
A session-to-GitHub tracker that creates, updates, and reads issues across repositories, including their labels, parent epics, and project-board placement.
weekly-retro
A structured weekly retrospective for a one-person business run with AI agents. It gathers evidence from code, project tools, and canonical business files, then records findings and outcomes.
art-director
Orchestrate iterative visual style searches with branch prompts, decision graphs, feedback loops, and final direction selection.
corp-doctor
A guided maintenance and setup tool for a Personal Corp system, meaning a business workflow built from AI agents, department repositories, and shared rules. It checks what exists before making changes.
html-draft
Use when user wants a standalone HTML diagram in flat engineering blueprint style — architecture diagrams, system flows, technical spec sheets, component maps. Generates one HTML file using Tailwind v4 (browser CDN) for layout and D3 v7 (CDN) for SVG diagrams. User-invoked only — do NOT auto-trigger. Triggers on…
idea
Use when capturing ONE new idea the user voices and wants recorded — "save this idea", "I have an idea", "log this idea", "/idea", "idea: ...". Creates a provenance-tracked folder (one folder per idea) in your ideas repo, dedups against an index, optionally mirrors to a GitHub Project view filtered by label:idea. NOT…