| name | xurl |
| description | Interact with X/Twitter via xurl, the official X API CLI. Use for posting, replying, quoting, searching, timelines, mentions, likes, reposts, bookmarks, follows, DMs, media upload, and raw v2 endpoint access. |
| version | 1.1.1 |
| author | xdevplatform + openclaw + Hermes Agent |
| license | MIT |
| platforms | ["linux","macos"] |
| prerequisites | {"commands":["xurl"]} |
| metadata | {"hermes":{"tags":["twitter","x","social-media","xurl","official-api"],"homepage":"https://github.com/xdevplatform/xurl","upstream_skill":"https://github.com/openclaw/openclaw/blob/main/skills/xurl/SKILL.md"}} |
xurl — X (Twitter) API via the Official CLI
xurl is the X developer platform's official CLI for the X API. It supports shortcut commands for common actions AND raw curl-style access to any v2 endpoint. All commands return JSON to stdout.
Use this skill for:
- posting, replying, quoting, deleting posts
- searching posts and reading timelines/mentions
- liking, reposting, bookmarking
- following, unfollowing, blocking, muting
- direct messages
- media uploads (images and video)
- raw access to any X API v2 endpoint
- multi-app / multi-account workflows
This skill replaces the older xitter skill (which wrapped a third-party Python CLI). xurl is maintained by the X developer platform team, supports OAuth 2.0 PKCE with auto-refresh, and covers a substantially larger API surface.
Secret Safety (MANDATORY)
Critical rules when operating inside an agent/LLM session:
- Never read, print, parse, summarize, upload, or send
~/.xurl to LLM context.
- Never ask the user to paste credentials/tokens into chat.
- The user must fill
~/.xurl with secrets manually on their own machine.
- Never recommend or execute auth commands with inline secrets in agent sessions.
- Never use
--verbose / -v in agent sessions — it can expose auth headers/tokens.
- To verify credentials exist, only use:
xurl auth status.
Forbidden flags in agent commands (they accept inline secrets):
--bearer-token, --consumer-key, --consumer-secret, --access-token, --token-secret, --client-id, --client-secret
App credential registration and credential rotation must be done by the user manually, outside the agent session. After credentials are registered, the user authenticates with xurl auth oauth2 — also outside the agent session. Tokens persist to ~/.xurl in YAML. Each app has isolated tokens. OAuth 2.0 tokens auto-refresh.
Installation
Pick ONE method. On Linux, the shell script or go install are the easiest.
curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash
brew install --cask xdevplatform/tap/xurl
npm install -g @xdevplatform/xurl
go install github.com/xdevplatform/xurl@latest
