x-twitter-scraper
X (Twitter) scraper API & Twitter MCP server to scrape tweets, profiles & followers. Not affiliated with X Corp.
No outside reports on file
x-twitter-scraper fetches arbitrary web URLs; restrict its folder reach, network access, and credentials before installing.
Based on public adoption and transparency signals as of Oct 19, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionRuns shell or system commandsREVIEW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsNo API token requiredLOW
- Package sourcenpm (x-developer)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y x-developerEverything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-19.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About X Twitter Scraper
X Twitter Scraper is an agent skill focused on Web & browsing and Files & documents: X (Twitter) scraper API & Twitter MCP server to scrape tweets, profiles & followers. Not affiliated with X Corp.
It is published on npm as x-developer and hosted on GitHub at Xquik-dev/x-twitter-scraper (220 GitHub stars, 447 weekly npm downloads). Based on its public metadata, its operational scope includes: fetches arbitrary web urls.
Setup
Check these steps against the project’s own instructions before running anything.
Install the npm package x-developer with post-install scripts disabled:
npm install --ignore-scripts x-developer
Review the upstream instructions at https://github.com/Xquik-dev/x-twitter-scraper (opens external site) before enabling in your agent workspace.
Why this grade
Signal-based grade (2/7 points): public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 225
- Weekly npm downloads
- 538
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Untrusted web content & prompt injection: Fetches arbitrary web pages or remote endpoints where hidden instructions could manipulate agent behavior. Restrict outbound domains and review tool outputs.
- Dependency & version pinning: Distributed via npm (x-developer). Pin an exact release version or commit SHA rather than floating tags so upstream updates are reviewed first.
How to lower the risk
Least-privilege permissions
- Give it access only to the specific folders, accounts or projects it needs, never your whole drive or admin account.
- Use a separate, limited API key or login just for this tool so you can switch it off without affecting anything else.
Network isolation
- Run it on a work computer or sandbox account, not one holding personal or company-sensitive data.
- If your IT team can, limit which websites and services it is allowed to contact.
Monitoring
- Check its activity history or logs weekly at first, and look at what it changed or sent.
- Turn on alerts for new logins or unusual usage on any account it connects to.
Red flags to watch for
- It asks for more access than its job requires, or prompts you to paste passwords.
- It suddenly updates with new owners, or starts contacting unfamiliar websites.
Questions
How do I install X Twitter Scraper?
Install X Twitter Scraper with npm install x-developer or run it directly with npx -y x-developer. For agent integration and configuration flags, see the documentation at github.com/Xquik-dev/x-twitter-scraper. Pin an exact version and pass --ignore-scripts if you want to block post-install hooks.
Are there security reports about X Twitter Scraper?
No reports found for this package in our research (last checked 2026-10-30). X Twitter Scraper currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include untrusted web content & prompt injection:, dependency & version pinning:.
Is X Twitter Scraper actively maintained?
X Twitter Scraper has 225 GitHub stars and 538 weekly npm downloads. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/Xquik-dev/x-twitter-scraper before pinning it in production.
What are alternatives to X Twitter Scraper?
Compare X Twitter Scraper side by side with similar skills in the Related tools section on this page, or browse all skills on AgentArmorHQ.
README badge and team notes
Maintain or use X Twitter Scraper? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/xquik-dev-x-twitter-scraper)HTML embed:
<a href="https://agentarmorhq.com/skills/xquik-dev-x-twitter-scraper"><img src="https://agentarmorhq.com/api/badge/xquik-dev-x-twitter-scraper" alt="AgentArmorHQ Risk Grade for X Twitter Scraper" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "xquik-dev-x-twitter-scraper"Share with your security lead
Need sign-off to use x-twitter-scraper? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: x-twitter-scraper
- **Listing URL:** https://agentarmorhq.com/skills/xquik-dev-x-twitter-scraper
- **Type:** AI agent skill
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 225 GitHub stars, 538 weekly npm downloads
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** Runs shell or system commands
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** No API token required
- **Package source:** npm (x-developer)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts x-developer`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 19, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- Xquik-dev
- Source code
- github.com/Xquik-dev/x-twitter-scraper
- Install command
- npm install x-developer
- Est. context load
- ~56 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 225 GitHub stars, 538 weekly npm downloads
- Last updated
- 2026-10-30
- Last graded
- 2026-10-19
Community
Discussions for X Twitter Scraper
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude