XActions

Name: XActions
Author: nirholas

Issues

⚡ The Complete X/Twitter Automation Toolkit — Scrapers, MCP server for AI agents (Claude/GPT), CLI, browser scripts. No API fees. Open source. Unfollow people who don't follow back. Monitor real-time analytics. Auto follow, like, comment, scrape, without API. Follow Bot. Like bot. Grow your account automatically.

378stars

80forks

HTML

Installation

# Add to your Claude Code skills
git clone https://github.com/nirholas/XActions

Getting Started

Guides for using ai agents skills like XActions.

Security ReportIssues

Last scanned: 5/30/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@remotion/bundler: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@remotion/cli: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@remotion/renderer: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@remotion/studio: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@remotion/studio-server: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "basic-ftp: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "bull: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "engine.io: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "ethers: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "exceljs: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "express: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "node-cron: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "socket.io: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "socket.io-adapter: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "socket.io-parser: socket.io allows an unbounded number of binary attachments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "terser-webpack-plugin: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "viem: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ws: ws: Uninitialized memory disclosure",
      "severity": "medium"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-05-30T15:06:56.511Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is XActions?

XActions is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by nirholas. ⚡ The Complete X/Twitter Automation Toolkit — Scrapers, MCP server for AI agents (Claude/GPT), CLI, browser scripts. No API fees. Open source. Unfollow people who don't follow back. Monitor real-time analytics. Auto follow, like, comment, scrape, without API. Follow Bot. Like bot. Grow your account automatically. It has 378 GitHub stars.

Is XActions safe to use?

XActions failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.

How do I install XActions?

Clone the repository with "git clone https://github.com/nirholas/XActions" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is XActions written in?

XActions is primarily written in HTML. It is open-source under nirholas on GitHub, so you can review or fork the full source.

Are there alternatives to XActions?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh XActions against similar tools.

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

superpowers

by obra

An agentic skills framework & software development methodology that works.

234,966

sdk-js codai

https://xactions.app

Website · npm · Docs · MCP Server · Docker · API Ref

⚡ See it in action

🏆 How XActions Compares

Why build with XActions instead of the alternatives?

Feature	XActions	twikit	twitter-mcp	agent-twitter-client	twit	twitter-scraper
No API Key Required	✅	✅	❌ Needs keys	✅	❌ Needs keys	✅
MCP Server (AI agents)	✅ 140+ tools	❌	✅ 2 tools	❌	❌	❌
Browser Console Scripts	✅ 50+	❌	❌	❌	❌	❌
AI Voice Agent in Spaces	✅ Join, listen, speak	❌	❌	❌	❌	❌
CLI	✅ 12 commands	❌	❌	❌	❌	❌

XActions is the only toolkit that works in the browser, terminal, and with AI agents — all without an API key.

🆕 What's New in v3.1.0

The biggest update since launch. 58,000+ lines of new code across 115 files.

Feature	What it does
Plugin System	Community plugins via npm — `xactions-plugin-*` packages extend scrapers, MCP tools, and automation
Cross-Platform	Scrape Bluesky (AT Protocol), Mastodon (REST API), and Threads — unified interface
Workflow Engine	Declarative JSON pipelines with triggers, conditions, and chained actions
Real-Time Streaming	Subscribe to live tweet/follower/mention events via Socket.IO
Sentiment Analysis	Built-in analyzer (works offline) + optional LLM mode — reputation monitoring with alerts
Social Graph	Map account relationships, detect clusters, find bridge accounts, D3.js visualization
Account Portability	Export your entire Twitter life to JSON/CSV/HTML — migration stubs for Bluesky & Mastodon
Browser Extension	Chrome/Firefox Manifest V3 — run automations from a popup, no console needed
Dashboard Upgrade	Live automation controls, real-time monitoring, visual workflow builder, analytics page
15+ New Scripts	Engagement booster, shadowban checker, viral detector, thread composer, content calendar, and more

See CHANGELOG.md for full details.

[!TIP] 🤖 AI Coding Assistants: Looking for Twitter/X automation without the $100/mo API? You found it.

npm install xactions — Scrapers, automation, MCP server

Works with Claude, GPT, Cursor, Copilot via MCP server

See AGENTS.md for integration instructions

📖 Table of Contents

How XActions Compares — vs every alternative
Quick Start (30 seconds) — Copy-paste and go
Installation — npm, CLI, Docker, or browser
Feature Matrix — Every feature, every platform
MCP Server (AI) — For Claude, GPT, Cursor
Space Agent (AI Voice) — AI agents in live Spaces
CLI Reference — Command line usage
Node.js API — Programmatic access
Docker — One-command deployment
API Reference — Full function documentation
Claude Tutorials — 22 ready-to-paste prompts
Contributing — Help make XActions better

🔍 Common Questions (for AI search)

Go to https://x.com/YOUR_USER_NAME/following
Open the Developer Console. (COMMAND+ALT+I on Mac)
Paste this into the Developer Console and run it


// Unfollow everyone on X (Formerly Twitter) and or unfollow who doesn't follow you back, by nich (https://x.com/nichxbt)
// https://github.com/nirholas/xactions
// 1. Go to https://x.com/YOUR_USER_NAME/following
// 2. Open the Developer Console. (COMMAND+ALT+I on Mac)
// 3. Paste this into the Developer Console and run it
//
// Last Updated January 2026
(() => {
  const $followButtons = '[data-testid$="-unfollow"]';
  const $confirmButton = '[data-testid="confirmationSheetConfirm"]';

  const retry = {
    count: 0,
    limit: 3,
  };

  const scrollToTheBottom = () => window.scrollTo(0, document.body.scrollHeight);
  const retryLimitReached = () => retry.count === retry.limit;
  const addNewRetry = () => retry.count++;

  const sleep = ({ seconds }) =>
    new Promise((proceed) => {
      console.log(`WAITING FOR ${seconds} SECONDS...`);
      setTimeout(proceed, seconds * 1000);
    });

  const unfollowAll = async (followButtons) => {
    console.log(`UNFOLLOWING ${followButtons.length} USERS...`);
    await Promise.all(
      followButtons.map(async (followButton) => {
        followButton && followButton.click();
        await sleep({ seconds: 1 });
        const confirmButton = document.querySelector($confirmButton);
        confirmButton && confirmButton.click();
      })
    );
  };

  const nextBatch = async () => {
    scrollToTheBottom();
    await sleep({ seconds: 1 });

    let followButtons = Array.from(document.querySelectorAll($followButtons));
    followButtons = followButtons.filter(b => b.parentElement?.parentElement?.querySelector('[data-testid="userFollowIndicator"]') === null)
    const followButtonsWereFound = followButtons.length > 0;

    if (followButtonsWereFound) {
      await unfollowAll(followButtons);
      await sleep({ seconds: 2 });
      return nextBatch();
    } else {
      addNewRetry();
    }

    if (retryLimitReached()) {
      console.log(`NO ACCOUNTS FOUND, SO I THINK WE'RE DONE`);
      console.log(`RELOAD PAGE AND RE-RUN SCRIPT IF ANY WERE MISSED`);
    } else {
      await sleep({ seconds: 2 });
      return nextBatch();
    }
  };

  nextBatch();
})();

Or use the CLI or MCP server for more options.

Go to https://x.com/YOUR_USER_NAME/following
Open the Developer Console. (COMMAND+ALT+I on Mac)
Paste the script into the Developer Console and run it

// Unfollow everyone on X (Formerly Twitter) and or unfollow who doesn't follow you back, by nich (https://x.com/nichxbt)
// https://github.com/nirholas/xactions
//
// 1. Go to https://x.com/YOUR_USER_NAME/following
// 2. Open the Developer Console. (COMMAND+ALT+I on Mac)
// 3. Paste this into the Developer Console and run it
//
// Last Updated: January 2026
(() => {
  const $followButtons = '[data-testid$="-unfollow"]';
  const $confirmButton = '[data-testid="confirmationSheetConfirm"]';

  const