Xurl
Let your coding agent post, reply, search, DM, and manage X engagement from the terminal without pasting API tokens into chat.
Overview
xurl is an agent skill for the Launch phase that runs the authenticated xurl CLI for X posts, reads, search, DMs, media, and raw v2 API calls without exposing tokens in chat.
Install
npx skills add https://github.com/steipete/clawdis --skill xurlWhat is this skill?
- Authenticated shortcuts for post, reply, quote, delete, read, search, timeline, mentions, likes, reposts, and bookmarks
- DM, media upload, follower lookups, whoami, and raw X API v2 calls when shortcuts are not enough
- Install via Homebrew tap or npm package `@xdevplatform/xurl` with `xurl` on PATH
- Agent-safe auth: never read `~/.xurl`, no inline secrets, no `--verbose` in agent sessions—check with `xurl auth status`
Adoption & trust: 1.7k installs on skills.sh; 378k GitHub stars; 1/3 security scanners passed (skills.sh audits).
What problem does it solve?
You want your agent to act on X from the repo or terminal but cannot safely paste OAuth tokens or debug verbose auth headers in a shared session.
Who is it for?
Solo builders shipping with Claude Code or Cursor who already use X for distribution and want scripted post/reply/search workflows.
Skip if: Teams that need a full social scheduler, analytics suite, or non-X networks—use a dedicated marketing stack instead of this CLI integration.
When should I use this skill?
User or agent needs authenticated X posts, replies, reads/search, DMs, media upload, followers, auth status, or raw v2 API calls via the xurl binary.
What do I get? / Deliverables
Your agent executes vetted xurl commands that return JSON results while credential files stay off-limits and auth is verified with `xurl auth status`.
- JSON results from shortcut commands (posts, search, timeline, engagement actions)
- Raw v2 API responses when using non-shortcut endpoints
Recommended Skills
Journey fit
Social distribution on X is a core launch motion for solo builders announcing products, threads, and replies. Shortcut commands cover posting, search, timeline, and engagement—the operational work of getting words in front of an audience on X.
How it compares
Use as a terminal integration skill, not an MCP server—commands map directly to X API shortcuts rather than abstract tool schemas.
Common Questions / FAQ
Who is xurl for?
Indie builders and agent users who publish or monitor on X from the command line and want install paths via brew or npm documented for their coding agent.
When should I use xurl?
During launch distribution when posting launch threads, replying to mentions, searching niche queries for positioning, or uploading media before a ship announcement.
Is xurl safe to install?
The skill mandates strict secret hygiene; review the Security Audits panel on this Prism page and treat `~/.xurl` as off-limits for agent inspection.
SKILL.md
READMESKILL.md - Xurl
# xurl Use `xurl` for X API work. Shortcut commands return JSON; raw mode works for any v2 endpoint. ## Secret safety - Never read, print, summarize, upload, or inspect `~/.xurl`. - Never ask user to paste tokens/secrets into chat. - Do not run auth commands with inline secrets. - Do not use `--verbose` in agent sessions; it can expose auth headers. - Check auth with `xurl auth status`. ## Common shortcuts ```bash xurl post "Hello world!" xurl reply POST_ID "Nice." xurl quote POST_ID "My take" xurl delete POST_ID xurl read POST_ID xurl search "query" -n 20 xurl whoami xurl user @handle xurl timeline -n 20 xurl mentions -n 10 xurl like POST_ID xurl unlike POST_ID xurl repost POST_ID xurl unrepost POST_ID xurl bookmark POST_ID xurl unbookmark POST_ID xurl followers -n 20 xurl following -n 20 xurl follow @handle xurl unfollow @handle xurl block @handle xurl unblock @handle xurl mute @handle xurl unmute @handle xurl dm @handle "message" xurl dms -n 10 ``` `POST_ID` can be a full `https://x.com/<user>/status/<id>` URL. ## Media ```bash xurl media upload image.jpg xurl media upload clip.mp4 xurl media status MEDIA_ID xurl post "caption" --media-id MEDIA_ID ``` Videos may need processing; poll `media status`. ## Auth/app management ```bash xurl auth status xurl auth apps list xurl auth default xurl auth default APP_NAME USERNAME xurl auth apps remove APP_NAME ``` Per request: ```bash xurl --app APP_NAME /2/users/me xurl --auth oauth2 /2/users/me ``` ## Raw API ```bash xurl /2/users/me xurl -X POST /2/tweets -d '{"text":"Hello world!"}' xurl '/2/tweets/search/recent?query=openclaw&max_results=10' ``` Use raw mode when shortcuts do not cover the endpoint. Keep payloads in temp files for complex JSON. ## Output and errors - JSON stdout on success. - Non-zero exit on API/auth/network errors. - 401/403: auth, scope, or app mismatch; check `xurl auth status`. - 429: rate limited; back off. - Media upload failures: check file type/size and media processing status.