xurllisted

# xurl — X (Twitter) API via the Official CLI `xurl` is the X developer platform's official CLI for the X API. It supports shortcut commands for common actions AND raw curl-style access to any v2 endpoint. All commands return JSON to stdout. Use this skill for: - posting, replying, quoting, deleting posts - searching posts and reading timelines/mentions - liking, reposting, bookmarking - following, unfollowing, blocking, muting - direct messages - media uploads (images and video) - raw access to any X API v2 endpoint - multi-app / multi-account workflows This skill replaces the older `xitter` skill (which wrapped a third-party Python CLI). `xurl` is maintained by the X developer platform team, supports OAuth 2.0 PKCE with auto-refresh, and covers a substantially larger API surface. --- ## Secret Safety (MANDATORY) Critical rules when operating inside an agent/LLM session: - **Never** read, print, parse, summarize, upload, or send `~/.xurl` to LLM context. - **Never** ask the user to paste credentials/tokens into chat. - The user must fill `~/.xurl` with secrets manually on their own machine. In Docker, this must be the `~` seen by Hermes tool subprocesses; see the Docker note below. - **Never** recommend or execute auth commands with inline secrets in agent sessions. - **Never** use `--verbose` / `-v` in agent sessions — it can expose auth headers/tokens. - To verify credentials exist, only use: `xurl auth status`. Forbidden flags in agent commands (they accept inline