Add X Twitter scraper skill

docs/README.skills.md

@@ -363,3 +363,4 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
 | [winui3-migration-guide](../skills/winui3-migration-guide/SKILL.md)<br />`gh skills install github/awesome-copilot winui3-migration-guide` | UWP-to-WinUI 3 migration reference. Maps legacy UWP APIs to correct Windows App SDK equivalents with before/after code snippets. Covers namespace changes, threading (CoreDispatcher to DispatcherQueue), windowing (CoreWindow to AppWindow), dialogs, pickers, sharing, printing, background tasks, and the most common Copilot code generation mistakes. | None |
 | [workiq-copilot](../skills/workiq-copilot/SKILL.md)<br />`gh skills install github/awesome-copilot workiq-copilot` | Guides the Copilot CLI on how to use the WorkIQ CLI/MCP server to query Microsoft 365 Copilot data (emails, meetings, docs, Teams, people) for live context, summaries, and recommendations. | None |
 | [write-coding-standards-from-file](../skills/write-coding-standards-from-file/SKILL.md)<br />`gh skills install github/awesome-copilot write-coding-standards-from-file` | Write a coding standards document for a project using the coding styles from the file(s) and/or folder(s) passed as arguments in the prompt. | None |
+| [x-twitter-scraper](../skills/x-twitter-scraper/SKILL.md)<br />`gh skills install github/awesome-copilot x-twitter-scraper` | Build GitHub Copilot workflows with Xquik X API SDKs, TweetClaw OpenClaw plugin, REST endpoints, MCP tools, signed webhooks, tweet search, user lookup, follower exports, media actions, and agent automation. | None |

skills/x-twitter-scraper/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: x-twitter-scraper
+description: 'Build GitHub Copilot workflows with Xquik X API SDKs, TweetClaw OpenClaw plugin, REST endpoints, MCP tools, signed webhooks, tweet search, user lookup, follower exports, media actions, and agent automation.'
+---
+
+# X Twitter Scraper
+
+Use this skill when a user wants to integrate Xquik into an app, script, data pipeline, or AI agent workflow for X API and Twitter scraper tasks.
+
+## Use Cases
+
+- Search tweets, fetch tweet details, read timelines, and download media.
+- Look up users, check relationships, and export followers or following.
+- Start extraction jobs for replies, reposts, quotes, likes, lists, communities, articles, and search results.
+- Create account monitors and verify HMAC-signed webhook events.
+- Use TweetClaw when the user wants a ready-made OpenClaw plugin instead of custom REST or SDK code.
+- Add TypeScript, Python, Go, Java, Kotlin, C#, Ruby, PHP, CLI, or Terraform clients.
+- Connect agent runtimes through the Xquik MCP server.
+
+## Source Checks
+
+Before writing code, inspect the current Xquik source material:
+
+- REST API docs: https://docs.xquik.com/api-reference/overview
+- SDK index: https://docs.xquik.com/sdks
+- OpenAPI spec: https://xquik.com/openapi.json
+- MCP server docs: https://docs.xquik.com/mcp
+- TweetClaw OpenClaw plugin: https://github.com/Xquik-dev/tweetclaw
+- TypeScript SDK: https://github.com/Xquik-dev/x-twitter-scraper-typescript
+- Skill repo: https://github.com/Xquik-dev/x-twitter-scraper
+
+Do not invent endpoint names, request fields, response fields, scopes, pricing, limits, or package names. Read the relevant SDK README and API reference page first.
+
+## Implementation Flow
+
+1. Identify the workflow: search, lookup, extraction, monitor, webhook, media, write action, billing, or MCP.
+2. Choose the integration surface: generated SDK for application code, REST for custom clients, MCP for agents, or webhooks for event delivery.
+3. Confirm authentication requirements from the docs and use environment variables for API keys.
+4. Use typed request and response models when an SDK exists for the user's language.
+5. Add retries and pagination according to the SDK or API docs.
+6. Add explicit user confirmation before write actions, payment flows, or long-running monitoring.
+7. Keep webhook verification server-side and compare HMAC signatures before processing events.
+8. Return structured data to the caller instead of scraping generated UI output.
+
+## TypeScript SDK Pattern
+
+Install the TypeScript SDK only after checking the current package README:
+
+```bash
+npm install x-twitter-scraper
+```
+
+Use server-side code for API calls:
+
+```ts
+import XTwitterScraper from "x-twitter-scraper";
+
+type SearchTweetsInput = {
+  query: string;
+  limit?: number;
+};
+
+export async function searchTweets(input: SearchTweetsInput) {
+  const client = new XTwitterScraper({
+    apiKey: process.env.X_TWITTER_SCRAPER_API_KEY,
+  });
+
+  return client.x.tweets.search({
+    q: input.query,
+    limit: input.limit ?? 10,
+  });
+}
+```
+
+## Webhook Pattern
+
+When adding webhook handlers:
+
+- Read the documented signing header name and payload format.
+- Verify the HMAC signature before parsing business logic.
+- Reject missing, malformed, or mismatched signatures.
+- Make handlers idempotent because webhook delivery can retry.
+- Store only the fields needed for the product workflow.
+
+## MCP Pattern
+
+Use the MCP server when the user wants an agent to explore or call Xquik tools directly. Keep application code on REST or SDK clients when the app needs stable typed contracts, tests, or internal abstractions.
+
+## OpenClaw Plugin Pattern
+
+Use TweetClaw when the user wants a packaged OpenClaw plugin for tweet search, posting tweets, tweet replies, follower export, media workflows, monitors, webhooks, and giveaway draws.
+
+Before installing, read the current TweetClaw README and plugin manifest. Install the official package:
+
+```bash
+openclaw plugins install @xquik/tweetclaw
+```
+
+Configure the Xquik API key or MPP signing key through OpenClaw config. MPP mode is read-only; do not attempt posts, replies, DMs, uploads, monitors, webhooks, profile changes, or other account-backed actions when only MPP signing is configured.
+
+## Safety And Accuracy
+
+- Keep language neutral and technical.
+- State that Xquik is a third-party X data and automation API.
+- Do not claim affiliation with X Corp.
+- Do not bypass access controls or platform policies.
+- Do not expose API keys, webhook secrets, account cookies, tokens, or raw signatures.
+- Do not hard-code credentials in examples or tests.
+- Do not document private infrastructure details.
+- Prefer official Xquik docs, SDK READMEs, and the OpenAPI spec over memory.