openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False Flag on xint (X Intelligence CLI) #190

New Issue
Open
opened 2026-02-15 17:16:07 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:07 -05:00
Owner
Copy Link
Copy Source

Originally created by @0xNyk on GitHub (Feb 15, 2026).

Hi — my skill xint was flagged as suspicious after publishing.
I believe this is a false positive.
Happy to provide any additional context needed.

Skill: xint
Slug: xint
Repo: https://github.com/0xNyk/xint

What xint does:

xint is an X/Twitter intelligence CLI — it searches X, analyzes bookmarks/likes, tracks trends, and pipes results
into Grok AI. It's a spiritual successor to twint, rebuilt for 2026 with Bun + TypeScript. MIT licensed.

Likely flag triggers and why they're legitimate:

  • lib/oauth.ts — Implements standard OAuth 2.0 PKCE flow for X API v2 authentication. This is the officially
    documented auth method from X's developer docs. No credentials are stored beyond the user's own tokens.
  • lib/engagement.ts — Analyzes engagement metrics on tweets (likes, retweets, reply ratios). It reads data, it
    does not automate engagement actions (no auto-liking, no auto-following, no spam).
  • lib/followers.ts — Retrieves follower/following data for analysis. Read-only — no follow/unfollow automation.
  • lib/api.ts — Makes authenticated HTTP requests to X's public API endpoints. Standard API client patterns.
  • lib/grok.ts — Pipes retrieved data to xAI's Grok API for analysis. Standard API integration, user provides
    their own API key.

No malicious patterns:

  • No credential exfiltration — tokens are stored locally in the user's own config directory
  • No automation of social actions (no auto-follow, auto-like, auto-post)
  • No scraping beyond standard API usage
  • No obfuscated code
  • All source is public and MIT licensed

Would appreciate a review when you get a chance. Happy to answer any questions or make changes if needed.

Originally created by @0xNyk on GitHub (Feb 15, 2026). Hi — my skill xint was flagged as suspicious after publishing. I believe this is a false positive. Happy to provide any additional context needed. Skill: xint Slug: xint Repo: https://github.com/0xNyk/xint What xint does: xint is an X/Twitter intelligence CLI — it searches X, analyzes bookmarks/likes, tracks trends, and pipes results into Grok AI. It's a spiritual successor to twint, rebuilt for 2026 with Bun + TypeScript. MIT licensed. Likely flag triggers and why they're legitimate: - lib/oauth.ts — Implements standard OAuth 2.0 PKCE flow for X API v2 authentication. This is the officially documented auth method from X's developer docs. No credentials are stored beyond the user's own tokens. - lib/engagement.ts — Analyzes engagement metrics on tweets (likes, retweets, reply ratios). It reads data, it does not automate engagement actions (no auto-liking, no auto-following, no spam). - lib/followers.ts — Retrieves follower/following data for analysis. Read-only — no follow/unfollow automation. - lib/api.ts — Makes authenticated HTTP requests to X's public API endpoints. Standard API client patterns. - lib/grok.ts — Pipes retrieved data to xAI's Grok API for analysis. Standard API integration, user provides their own API key. No malicious patterns: - No credential exfiltration — tokens are stored locally in the user's own config directory - No automation of social actions (no auto-follow, auto-like, auto-post) - No scraping beyond standard API usage - No obfuscated code - All source is public and MIT licensed Would appreciate a review when you get a chance. Happy to answer any questions or make changes if needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#190
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?