Skip to content

skill-harvest-xurl.md

Latest commit

 

History

History
99 lines (67 loc) · 3.21 KB

skill-harvest-xurl.md

File metadata and controls

99 lines (67 loc) · 3.21 KB
Raw
domain archive
title Xurl
verification metadata-normalized
source skill-pipeline
status draft
created 2026-05-09

背景

（此 lesson 从 skill xurl 自动提取，待补全）

根因

（待补充）

修复

xurl — X (Twitter) API via the Official CLI

xurl is the X developer platform's official CLI for the X API. It supports shortcut commands for common actions AND raw curl-style access to any v2 endpoint. All commands return JSON to stdout.

Use this skill for:

  • posting, replying, quoting, deleting posts
  • searching posts and reading timelines/mentions
  • liking, reposting, bookmarking
  • following, unfollowing, blocking, muting
  • direct messages
  • media uploads (images and video)
  • raw access to any X API v2 endpoint
  • multi-app / multi-account workflows

This skill replaces the older xitter skill (which wrapped a third-party Python CLI). xurl is maintained by the X developer platform team, supports OAuth 2.0 PKCE with auto-refresh, and covers a substantially larger API surface.

Secret Safety (MANDATORY)

Critical rules when operating inside an agent/LLM session:

  • Never read, print, parse, summarize, upload, or send ~/.xurl to LLM context.
  • Never ask the user to paste credentials/tokens into chat.
  • The user must fill ~/.xurl with secrets manually on their own machine.
  • Never recommend or execute auth commands with inline secrets in agent sessions.
  • Never use --verbose / -v in agent sessions — it can expose auth headers/tokens.
  • To verify credentials exist, only use: xurl auth status.

Forbidden flags in agent commands (they accept inline secrets): --bearer-token, --consumer-key, --consumer-secret, --access-token, --token-secret, --client-id, --client-secret

App credential registration and credential rotation must be done by the user manually, outside the agent session. After credentials are registered, the user authenticates with xurl auth oauth2 — also outside the agent session. Tokens persist to ~/.xurl in YAML. Each app has isolated tokens. OAuth 2.0 tokens auto-refresh.

Installation

Pick ONE method. On Linux, the shell script or go install are the easiest.

# Shell script (installs to ~/.local/bin, no sudo, works on Linux + macOS)
curl -fsSL https://raw.githubusercontent.com/xdevplatform/xurl/main/install.sh | bash

# Homebrew (macOS)
brew install --cask xdevplatform/tap/xurl

# npm
npm install -g @xdevplatform/xurl

# Go
go install github.com/xdevplatform/xurl@latest

Verify:

xurl --help
xurl auth status

If xurl is installed but auth status shows no apps or tokens, the user needs to complete auth manually — see the next section.

One-Time User Setup (user runs these outside the agent)

These steps must be performed by the user directly, NOT by the agent, because they involve pasting secrets. Direct the user to this block; do not execute it for them.

  1. Create or open an app at https://developer.x.com/en/portal/dashboard
  2. Set the redirect URI to http://localhost:8080/callback
  3. Copy the app's Client ID and Client Secret
  4. Register the app locally (user runs this): 
    xurl auth apps add my-app --client-id YOUR

验证

（待补充）