Xurl

Name: Xurl
Author: steipete

steipete/clawdis

3k installs
385k repo stars
Updated August 3, 2026
steipete/clawdis

xurl is an agent skill for the xurl CLI to post, search, read, and manage X API v2 actions with JSON output and auth safety rules.

About

xurl is an agent skill for the xurl CLI that wraps authenticated X API v2 work with shortcut commands returning JSON. It covers posting, replies, quotes, deletes, reads, search, timelines, mentions, likes, reposts, bookmarks, followers, blocks, mutes, and direct messages, plus media upload with processing status polling before attaching media-id to posts. Auth guidance stresses never reading or printing ~/.xurl, avoiding inline secrets, skipping --verbose in agent sessions, and checking xurl auth status before calls. Raw mode supports arbitrary v2 endpoints when shortcuts are insufficient, and per-request app or oauth2 overrides are documented for multi-account setups. Agents install via Homebrew xdevplatform/tap/xurl or npm @xdevplatform/xurl. Error handling notes 401 and 403 auth mismatches, 429 rate limits with backoff, and media upload failures from file type or processing state. Use it when automating X posts, searching recent tweets, managing social interactions, or calling niche v2 endpoints from agent workflows.

Shortcut commands for post, reply, search, timeline, mentions, DMs, and social actions with JSON stdout.
Secret safety rules: never read ~/.xurl, avoid --verbose, check xurl auth status first.
Media upload flow with status polling before attaching media-id to posts.
Raw v2 API mode for endpoints not covered by shortcuts.
Install via brew xdevplatform/tap/xurl or npm @xdevplatform/xurl.

Xurl by the numbers

3,037 all-time installs (skills.sh)
+163 installs in the week ending Aug 2, 2026 (Skillselion tracking)
Ranked #71 of 550 CLI & Terminal skills by installs in the Skillselion catalog
Security screen: CRITICAL risk (skills.sh audit)
Data as of Aug 3, 2026 (Skillselion catalog sync)

At a glance

xurl capabilities & compatibility

Capabilities: x post, reply, quote, delete, and read shortcuts · search, timeline, mentions, and user lookup comm · follower, block, mute, like, and bookmark manage · media upload with processing status polling · raw v2 api calls with per app auth overrides
Works with: chrome
Use cases: orchestration · marketing

From the docs

What xurl says it does

Shortcut commands return JSON; raw mode works for any v2 endpoint.

SKILL.md

npx skills add https://github.com/steipete/clawdis --skill xurl

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/steipete/clawdis/xurl.svg)](https://skillselion.com/skills/steipete/clawdis/xurl)

Installs	3k
repo stars	★ 385k
Security audit	1 / 3 scanners passed
Last updated	August 3, 2026
Repository	steipete/clawdis ↗

How do I let an agent interact with X posts, search, and DMs without exposing tokens or guessing CLI auth flags?

Post, search, read, and manage X content and DMs through the xurl CLI with JSON output and safe auth handling.

Who is it for?

Agents automating X social actions through the official xurl CLI with documented shortcuts.

Skip if: Skip when you need non-X social platforms or browser-only posting without API credentials.

When should I use this skill?

User asks to post on X, search tweets, read timelines, send DMs, or call X API v2 endpoints via xurl.

What you get

Successful xurl commands with JSON results, safe auth checks, and correct handling of media and rate limits.

JSON results from X API shortcut or raw commands

By the numbers

Installable via brew formula xdevplatform/tap/xurl or npm @xdevplatform/xurl

Files

SKILL.mdMarkdownGitHub ↗

xurl

Use xurl for X API work. Shortcut commands return JSON; raw mode works for any v2 endpoint.

Secret safety

Never read, print, summarize, upload, or inspect ~/.xurl.
Never ask user to paste tokens/secrets into chat.
Do not run auth commands with inline secrets.
Do not use --verbose in agent sessions; it can expose auth headers.
Check auth with xurl auth status.

Common shortcuts

xurl post "Hello world!"
xurl reply POST_ID "Nice."
xurl quote POST_ID "My take"
xurl delete POST_ID
xurl read POST_ID
xurl search "query" -n 20
xurl whoami
xurl user @handle
xurl timeline -n 20
xurl mentions -n 10
xurl like POST_ID
xurl unlike POST_ID
xurl repost POST_ID
xurl unrepost POST_ID
xurl bookmark POST_ID
xurl unbookmark POST_ID
xurl followers -n 20
xurl following -n 20
xurl follow @handle
xurl unfollow @handle
xurl block @handle
xurl unblock @handle
xurl mute @handle
xurl unmute @handle
xurl dm @handle "message"
xurl dms -n 10

POST_ID can be a full https://x.com/<user>/status/<id> URL.

Media

xurl media upload image.jpg
xurl media upload clip.mp4
xurl media status MEDIA_ID
xurl post "caption" --media-id MEDIA_ID

Videos may need processing; poll media status.

Auth/app management

xurl auth status
xurl auth apps list
xurl auth default
xurl auth default APP_NAME USERNAME
xurl auth apps remove APP_NAME

Per request:

xurl --app APP_NAME /2/users/me
xurl --auth oauth2 /2/users/me

Raw API

xurl /2/users/me
xurl -X POST /2/tweets -d '{"text":"Hello world!"}'
xurl '/2/tweets/search/recent?query=openclaw&max_results=10'

Use raw mode when shortcuts do not cover the endpoint. Keep payloads in temp files for complex JSON.

Output and errors

JSON stdout on success.
Non-zero exit on API/auth/network errors.
401/403: auth, scope, or app mismatch; check xurl auth status.
429: rate limited; back off.
Media upload failures: check file type/size and media processing status.

Related skills

Lark SharedWire Feishu/Lark Open Platform auth, tokens, and shared API helpers into agent-built bots and internal tools.493k

Runcomfy CliLet their coding agent call any RunComfy model from the terminal or scripts without managing separate SDKs.298k30

Skills CliDiscover, install, update, and manage reusable agent capabilities from the open Skillselion ecosystem directly inside their coding agent.270k72

TzstCreate, extract, list, and script `.tzst` / `.tar.zst` archives from the terminal with the right compression, streaming, and conflict flags.267k72

XdropPull files from an Xdrop share URL, decrypt them locally, and land outputs in a chosen directory with optional JSON for automation.266k72

WizardAuthor interactive bash setup wizards that open URLs, capture secrets, write .env upserts, and set GitHub Actions secrets step by step.92.1k193k

How it compares

Pick xurl for shell-first X API v2 access instead of building and maintaining a bespoke OAuth HTTP client per endpoint.

FAQ

How should agents handle X credentials?

Never read ~/.xurl or ask users to paste tokens; check xurl auth status and avoid --verbose in sessions.

What if a shortcut does not cover my endpoint?

Use raw mode: xurl /2/... or xurl -X POST with JSON payloads, preferably from temp files.

How do media posts work?

Run xurl media upload, poll media status if needed, then post with --media-id.

Is Xurl safe to install?

skills.sh reports 1 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.

CLI & Terminaldistributioncontent