github HTML re-analysis due deep scan · partial (212/4,112 files)

nirholas/XActions

⚡ The Complete X/Twitter Automation Toolkit — Scrapers, MCP server for AI agents (Claude/GPT), CLI, browser scripts. No API fees. Open source. Unfollow people who don't follow back. Monitor real-time analytics. Auto follow, like, comment, scrape, without API. Follow Bot. Like bot. Grow your account automatically.

maintainer: nirholas
licence: Apache-2.0
first seen: 2026-06-01
last seen: 2026-09-17
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-09-14 code analysis flagged dynamic code execution in nirholas/XActions
HIGH 2026-08-30 code analysis flagged dynamic code execution in nirholas/XActions
HIGH 2026-08-07 code analysis flagged dynamic code execution ×4 in nirholas/XActions
HIGH 2026-07-29 code analysis flagged dynamic code execution ×4 in nirholas/XActions
HIGH 2026-07-15 code analysis flagged dynamic code execution ×3 in nirholas/XActions
HIGH 2026-07-06 code analysis flagged dynamic code execution ×3 in nirholas/XActions
HIGH 2026-07-02 code analysis flagged dynamic code execution ×3 in nirholas/XActions
HIGH 2026-06-25 code analysis flagged dynamic code execution ×3 in nirholas/XActions

tool count over time

06-01 12:39 now

2026-06-01 4t

2026-06-18 4t

capabilities 4 tools

transport stdio · streamable-http · http verified reported listed in the official MCP registry counts 4 tools · 0 res · 0 prompts permission surface via README inference

tools

x_space_join

Join a Space with an autonomous AI voice agent
x_space_leave

Leave the active Space and get session summary
x_space_status

Get agent status (duration, transcription/response counts)
x_space_transcript

Get recent transcriptions from the active Space

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 38383aa · analyzer v33 · 3d ago

skills & prompt files 40

danger signals9

dynamic code execution eval() nirholas-XActions-38383aa/api/services/operations/puppeteer/scriptRunner.js :186 return Promise.resolve(eval(code));
dynamic code execution new Function() nirholas-XActions-38383aa/python/site/assets/javascripts/lunr/wordcut.js :5977 var render = new Function(settings.variable || 'obj', '_', source);
dynamic code execution vm exec nirholas-XActions-38383aa/scripts/build-toolkit.mjs :284 try { defaults = vm.runInNewContext('(' + objText + ')', {}, { timeout: 1000 }); }
dynamic code execution new Function() nirholas-XActions-38383aa/src/scrapers/adapters/got-jsdom.js :206 const wrappedFn = new Function('window', 'document', 'navigator', ...args.map((_, i) => `__arg${i}`),
dynamic code execution new Function() nirholas-XActions-38383aa/tests/scripts/engageProfile.test.js :25 new Function(SOURCE)();
suspicious endpoint api.telegram.org nirholas-XActions-38383aa/src/notifications/notifier.js :207 const response = await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, {
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose nirholas-XActions-38383aa/src/plugins/google-sheets/index.js :62 scopes: ['https://www.googleapis.com/auth/spreadsheets'],
committed secret Anthropic key nirholas-XActions-38383aa/xspace-agents/examples/multi-agent-debate/.env.example :8 sk-ant…(34 chars, redacted)
committed secret Anthropic key nirholas-XActions-38383aa/xspace-agents/packages/core/src/__tests__/security.test.ts :93 sk-ant…(39 chars, redacted)

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1800

filesystem 175

fs nirholas-XActions-38383aa/api/routes/agent.js :23 import fs from 'fs';
fs nirholas-XActions-38383aa/api/routes/ask.js :17 import { readFile } from 'node:fs/promises';
fs nirholas-XActions-38383aa/api/routes/portability.js :18 import { promises as fs } from 'fs';
fs nirholas-XActions-38383aa/api/routes/scripts.js :17 import { readFile } from 'fs/promises';
fs nirholas-XActions-38383aa/api/services/operations/puppeteer/scriptRunner.js :18 import { readFile } from 'fs/promises';
fs (weak) nirholas-XActions-38383aa/examples/05-export-followers.js :22 import { createWriteStream } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/examples/06-find-non-followers.js :28 import { writeFile } from 'node:fs/promises';
fs (weak) nirholas-XActions-38383aa/examples/09-draft-approval.js :28 import { mkdtemp, rm } from 'node:fs/promises';
fs nirholas-XActions-38383aa/extension/generate-icons.cjs :4 const fs = require('fs');
fs nirholas-XActions-38383aa/python/site/assets/javascripts/lunr/wordcut.js :1857 var fs = require('fs')
fs (weak) nirholas-XActions-38383aa/scripts/add-license-notices.mjs :28 import { readFileSync, writeFileSync, readdirSync, statSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/audit-console-errors.js :8 import { readdir, writeFile } from 'fs/promises';

show 28 more

fs (weak) nirholas-XActions-38383aa/scripts/audit-docs.mjs :30 import { readFileSync, existsSync, readdirSync, statSync, writeFileSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/audit-site.mjs :34 import fs from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-all-docs.js :32 import fs from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-ask-actions.mjs :27 import { readFileSync, writeFileSync, readdirSync, existsSync, statSync, mkdirSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-ask-index.mjs :29 import { readFileSync, writeFileSync, readdirSync, existsSync, statSync, mkdirSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-browser-scripts-doc.mjs :28 import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-cloudflare.mjs :23 import { cpSync, rmSync, mkdirSync, readdirSync, statSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-docs-pages.js :10 import fs from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-index-pages.mjs :25 import fs from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-mcpb.mjs :43 import { cpSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, existsSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-playground.mjs :23 import { readFile, writeFile, mkdir, copyFile } from 'node:fs/promises';
fs (weak) nirholas-XActions-38383aa/scripts/build-script-pages.js :10 import fs from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-sitemap.js :10 import fs from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/build-toolkit.mjs :20 import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/check-x402-routes.mjs :34 import { readFileSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/create-x402-wallets.mjs :41 import fs from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/fix-doc-links.js :25 import fs from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/gen3.js :2 import { writeFileSync } from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/generate-missing-docs.js :9 import fs from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles-2.js :2 import { writeFileSync, mkdirSync } from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles.js :2 import { writeFileSync, mkdirSync } from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/normalize-license-headers.mjs :26 import { readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/sync-registry.mjs :24 import { readdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/sync-user-agents.mjs :42 import fs from 'node:fs/promises';
fs (weak) nirholas-XActions-38383aa/scripts/sync-x-endpoints.mjs :49 import fs from 'node:fs/promises';
fs (weak) nirholas-XActions-38383aa/scripts/test-x402-payment.js :34 import { existsSync } from 'fs';
fs (weak) nirholas-XActions-38383aa/scripts/verify-live.mjs :38 import fs from 'node:fs';
fs (weak) nirholas-XActions-38383aa/scripts/verify-x402.js :19 import { existsSync } from 'fs';

135 more not shown — this panel samples each group; the count above is the real total.

shell / exec 19

shell (weak) nirholas-XActions-38383aa/examples/08-mcp-tool-call.js :23 import { spawn } from 'node:child_process';
shell (weak) nirholas-XActions-38383aa/examples/09-draft-approval.js :27 import { spawn } from 'node:child_process';
shell (weak) nirholas-XActions-38383aa/scripts/build-ask-index.mjs :33 import { execFileSync } from 'node:child_process';
shell (weak) nirholas-XActions-38383aa/scripts/build-mcpb.mjs :42 import { execFileSync } from 'node:child_process';
shell (weak) nirholas-XActions-38383aa/scripts/build-toolkit.mjs :21 import { execFileSync } from 'node:child_process';
shell nirholas-XActions-38383aa/src/client/auth/cookieImport.js :31 import { execFileSync } from 'node:child_process';
shell nirholas-XActions-38383aa/src/plugins/manager.js :11 import { execSync } from 'child_process';
shell nirholas-XActions-38383aa/src/scheduler/scheduler.js :13 import { execFile, spawn } from 'child_process';
shell (weak) nirholas-XActions-38383aa/tests/ask/surfaces.test.js :8 import { spawn } from 'node:child_process';
shell (weak) nirholas-XActions-38383aa/tests/cli/archive.test.js :5 import { execFileSync } from 'node:child_process';
shell (weak) nirholas-XActions-38383aa/tests/cli/completion.test.js :6 import { execFileSync } from 'child_process';
shell (weak) nirholas-XActions-38383aa/tests/cli/drafts.test.js :5 import { execFileSync } from 'node:child_process';

show 7 more

shell (weak) nirholas-XActions-38383aa/tests/cli/skills.test.js :5 import { execFileSync } from 'node:child_process';
shell nirholas-XActions-38383aa/xspace-agents/packages/core/src/audio/bridge.ts :522 const { execSync } = require("child_process") as typeof import("child_process");
shell nirholas-XActions-38383aa/xspace-agents/packages/create-xspace-agent/src/index.ts :10 import * as childProcess from 'child_process';
shell nirholas-XActions-38383aa/xspace-agents/src/audio/bridge.ts :5 import { execSync } from "child_process"
shell nirholas-XActions-38383aa/xspace-agents/src/server/utils/security.ts :16 const SHELL_META_RE = /[;|&$`\\!#~<>{}()\[\]]/
shell nirholas-XActions-38383aa/xspace-agents/x-spaces/audio-bridge.js :8 const { execSync } = require("child_process")
shell nirholas-XActions-38383aa/xspace-agents/xspace-agent/src/spaces/audio-bridge.ts :5 import { execSync } from "node:child_process";

network 182

net nirholas-XActions-38383aa/api/routes/ai/actions.js :42 const response = await fetch('https://x.com/i/api/graphql/homeTimeline', {
net nirholas-XActions-38383aa/api/routes/ai/notifications.js :92 const response = await fetch(webhookUrl, {
net nirholas-XActions-38383aa/api/routes/ai/sentiment.js :132 limit: { type: 'number', default: 50, description: 'Max tweets to fetch (query mode)' },
net nirholas-XActions-38383aa/api/routes/twitter.js :3 import axios from 'axios';
net nirholas-XActions-38383aa/api/routes/video.js :145 const videoResponse = await fetch(decodedUrl, {
net nirholas-XActions-38383aa/api/server.js :10 import { createServer } from 'http';
net nirholas-XActions-38383aa/api/services/jobQueue.js :357 fetch(url, {
net nirholas-XActions-38383aa/api/services/licensing.js :95 fetch('https://telemetry.xactions.app/ping', {
net nirholas-XActions-38383aa/api/services/payment-webhooks.js :142 const response = await fetch(url, {
net nirholas-XActions-38383aa/api/services/threadSummarizer.js :84 const response = await fetch('https://openrouter.ai/api/v1/chat/completions', {
net nirholas-XActions-38383aa/api/services/unfollowerAlerts.js :152 const response = await fetch(schedule.webhookUrl, {
net nirholas-XActions-38383aa/api/services/videoExtractor.js :418 const response = await fetch(embedUrl);

show 28 more

net nirholas-XActions-38383aa/archive/backend/crypto-payments.js :341 const response = await fetch('https://api.commerce.coinbase.com/charges', {
net (weak) nirholas-XActions-38383aa/dashboard/docs/assets/docs.js :254 loading = fetch('/docs/search-index.json')
net nirholas-XActions-38383aa/dashboard/js/analytics.js :148 const res = await fetch(API_BASE + '/sentiment', {
net nirholas-XActions-38383aa/dashboard/js/ask.js :252 res = await fetch(`${base}/ask`, {
net nirholas-XActions-38383aa/dashboard/js/ask/engine.js :164 fetch(`https://api.github.com/search/issues?q=${encodeURIComponent(`repo:${REPO} ${q}`)}&per_page=4`, { headers, signal: controller.signal }),
net nirholas-XActions-38383aa/dashboard/js/ask/lanes.js :167 const res = await fetch(lane.url, {
net nirholas-XActions-38383aa/dashboard/js/config.js :65 const response = await fetch(url, mergedOptions);
net nirholas-XActions-38383aa/dashboard/js/paymentModal.js :3 * apiFetch — drop-in replacement for fetch() that intercepts 402 responses
net nirholas-XActions-38383aa/dashboard/js/sidebar.js :168 fetch(`${apiBase}/user/me`, {
net (weak) nirholas-XActions-38383aa/dashboard/playground/assets/playground.js :667 const response = await fetch(`${API_BASE}${apiPathFor(query)}`, { headers: { accept: 'application/json' } });
net (weak) nirholas-XActions-38383aa/examples/07-keyword-monitor.js :111 await fetch(webhook, {
net nirholas-XActions-38383aa/extension/background/service-worker.js :161 const res = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body) });
net nirholas-XActions-38383aa/functions/api/[[path]].js :42 const response = await fetch(upstream, {
net nirholas-XActions-38383aa/functions/api/ask.js :35 indexPromise = env.ASSETS.fetch(new Request(new URL('/data/ask-index.json', url)))
net nirholas-XActions-38383aa/functions/api/video/download.js :45 const upstream = await fetch(media.href, { headers: UPSTREAM_HEADERS });
net nirholas-XActions-38383aa/functions/mcp.js :120 return env.ASSETS.fetch(new Request(new URL('/mcp-docs', url), request));
net (weak) nirholas-XActions-38383aa/packages/x402-mcp/example/worker.js :23 fetch(request, env) {
net nirholas-XActions-38383aa/packages/x402-mcp/src/x402.js :196 this._fetch = fetchImpl ? (...args) => fetchImpl(...args) : (...args) => fetch(...args);
net nirholas-XActions-38383aa/packages/xactions-edge/cli.js :129 const response = await fetch(url);
net nirholas-XActions-38383aa/packages/xactions-edge/index.js :160 response = await this.fetch(this.endpoint, {
net (weak) nirholas-XActions-38383aa/playground/public/assets/playground.js :667 const response = await fetch(`${API_BASE}${apiPathFor(query)}`, { headers: { accept: 'application/json' } });
net (weak) nirholas-XActions-38383aa/scripts/audit-console-errors.js :159 const res = await fetch(BASE_URL);
net (weak) nirholas-XActions-38383aa/scripts/audit-site.mjs :231 const res = await fetch(url, { ...init, signal: controller.signal, redirect: 'follow' });
net (weak) nirholas-XActions-38383aa/scripts/check-endpoints.mjs :118 const res = await fetch('https://api.x.com/1.1/guest/activate.json', {
net (weak) nirholas-XActions-38383aa/scripts/engageProfile.js :474 const res = await fetch('https://api.x.ai/v1/chat/completions', {
net (weak) nirholas-XActions-38383aa/scripts/gen3.js :20 const res = await fetch('https://api.koinly.io/api/v2/transactions', {
net (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles-2.js :126 const res = await fetch(\`\${this.baseUrl}/api/v3/order?\${this.sign(params)}\`, {
net (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles.js :34 const res = await fetch(

142 more not shown — this panel samples each group; the count above is the real total.

secrets 118

secrets nirholas-XActions-38383aa/api/middleware/auth.js :17 const decoded = jwt.verify(token, process.env.JWT_SECRET);
secrets nirholas-XActions-38383aa/api/realtime/socketHandler.js :37 const decoded = jwt.verify(token, process.env.JWT_SECRET);
secrets nirholas-XActions-38383aa/api/routes/admin.js :213 stripe: Boolean(process.env.STRIPE_SECRET_KEY),
secrets nirholas-XActions-38383aa/api/routes/auth.js :72 process.env.JWT_SECRET,
secrets nirholas-XActions-38383aa/api/routes/session-auth.js :16 process.env.COOKIE_ENCRYPTION_KEY || process.env.SESSION_SECRET || process.env.JWT_SECRET;
secrets nirholas-XActions-38383aa/api/routes/twitter.js :15 const TWITTER_CLIENT_SECRET = process.env.TWITTER_CLIENT_SECRET;
secrets nirholas-XActions-38383aa/api/routes/webhooks.js :22 const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
secrets nirholas-XActions-38383aa/api/server.js :36 const placeholder = process.env.JWT_SECRET?.includes('change-this');
secrets nirholas-XActions-38383aa/api/services/jobQueue.js :34 password: process.env.REDIS_PASSWORD
secrets nirholas-XActions-38383aa/api/services/licensing.js :90 hasLicense: !!process.env.XACTIONS_LICENSE_KEY,
secrets nirholas-XActions-38383aa/api/services/payment-webhooks.js :21 const WEBHOOK_SECRET = process.env.X402_WEBHOOK_SECRET;
secrets nirholas-XActions-38383aa/api/services/stripeService.js :16 if (!process.env.STRIPE_SECRET_KEY) {

show 28 more

secrets nirholas-XActions-38383aa/api/services/threadSummarizer.js :40 const apiKey = providedKey || process.env.OPENROUTER_API_KEY;
secrets nirholas-XActions-38383aa/api/services/videoExtractor.js :34 const BEARER_TOKEN = process.env.TWITTER_BEARER_TOKEN || '';
secrets nirholas-XActions-38383aa/api/utils/secrets.js :5 * Signing keys used to have inline fallbacks (`process.env.JWT_SECRET || 'dev-secret'`,
secrets nirholas-XActions-38383aa/api/utils/security.js :10 const secret = process.env.JWT_SECRET;
secrets nirholas-XActions-38383aa/archive/backend/crypto-payments.js :83 if (process.env.COINBASE_COMMERCE_API_KEY) {
secrets nirholas-XActions-38383aa/archive/backend/payments.js :8 const stripe = Stripe(process.env.STRIPE_SECRET_KEY);
secrets nirholas-XActions-38383aa/archive/backend/webhooks.js :7 const stripe = Stripe(process.env.STRIPE_SECRET_KEY);
secrets (weak) nirholas-XActions-38383aa/examples/08-mcp-tool-call.js :43 env: { ...process.env, XACTIONS_SESSION_COOKIE: process.env.X_AUTH_TOKEN || '' },
secrets (weak) nirholas-XActions-38383aa/examples/auth.js :71 const authToken = process.env.X_AUTH_TOKEN;
secrets (weak) nirholas-XActions-38383aa/scripts/check-endpoints.mjs :203 const authToken = process.env.X_AUTH_TOKEN;
secrets (weak) nirholas-XActions-38383aa/scripts/gen3.js :23 'Authorization': \`Token \${process.env.KOINLY_TOKEN}\`,
secrets (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles-2.js :168 const orders = new OrderManager(process.env.BINANCE_KEY, process.env.BINANCE_SECRET);
secrets (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles.js :255 const signer = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
secrets (weak) nirholas-XActions-38383aa/scripts/submit-to-glama.js :11 const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
secrets (weak) nirholas-XActions-38383aa/scripts/sync-user-agents.mjs :98 if (process.env.GITHUB_TOKEN) apiHeaders.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
secrets (weak) nirholas-XActions-38383aa/scripts/sync-x-endpoints.mjs :79 if (process.env.GITHUB_TOKEN) headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
secrets (weak) nirholas-XActions-38383aa/scripts/test-x402-payment.js :57 const pk = process.env.X402_PRIVATE_KEY || generatePrivateKey();
secrets (weak) nirholas-XActions-38383aa/scripts/verify-x402.js :250 if (process.env.X402_PRIVATE_KEY) {
secrets (weak) nirholas-XActions-38383aa/scripts/x402-pay.mjs :142 const secret = process.env.X402_BUYER_SOLANA_SECRET;
secrets nirholas-XActions-38383aa/src/agents/llmBrain.js :37 this.apiKey = config.apiKey || process.env.OPENROUTER_API_KEY || process.env.OPENAI_API_KEY || '';
secrets nirholas-XActions-38383aa/src/agents/thoughtLeaderAgent.js :54 apiKey: config.llm?.apiKey || process.env.OPENROUTER_API_KEY || '',
secrets nirholas-XActions-38383aa/src/ai/contentOptimizer.js :29 const apiKey = process.env.OPENROUTER_API_KEY;
secrets nirholas-XActions-38383aa/src/ai/tweetGenerator.js :32 const apiKey = options.apiKey || process.env.OPENROUTER_API_KEY;
secrets nirholas-XActions-38383aa/src/algorithmBuilder.js :192 const apiKey = persona.llm.apiKey || process.env.OPENROUTER_API_KEY;
secrets nirholas-XActions-38383aa/src/analytics/sentiment.js :225 const apiKey = options.apiKey || process.env.OPENROUTER_API_KEY;
secrets nirholas-XActions-38383aa/src/cli/index.js :2124 const token = config.auth_token || process.env.TWITTER_AUTH_TOKEN;
secrets nirholas-XActions-38383aa/src/mcp/local-tools.js :90 const csrfToken = process.env.XACTIONS_CSRF_TOKEN;
secrets nirholas-XActions-38383aa/src/mcp/server.js :67 const X402_PRIVATE_KEY = process.env.X402_PRIVATE_KEY;

78 more not shown — this panel samples each group; the count above is the real total.

database 47

db nirholas-XActions-38383aa/api/middleware/auth.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/realtime/socketHandler.js :4 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/auth.js :5 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/bookmarks.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/creator.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/discovery.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/engagement.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/messages.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/operations.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/posting.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/profile.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/session-auth.js :5 import { PrismaClient } from '@prisma/client';

show 28 more

db nirholas-XActions-38383aa/api/routes/settings.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/spaces.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/twitter.js :5 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/unfollowers.js :19 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/routes/user.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/followerScanner.js :13 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/jobQueue.js :3 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/licenseManager.js :10 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/monitoring.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/operations/autoComment.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/operations/autoLike.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/operations/detectUnfollowers.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/operations/followEngagers.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/operations/keywordFollow.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/operations/unfollowEveryone.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/operations/unfollowNonFollowers.js :2 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/stripeService.js :10 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/unfollowerAlerts.js :17 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/api/services/unfollowerScheduler.js :21 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/archive/backend/crypto-payments.js :4 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/archive/backend/payments.js :4 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/archive/backend/webhooks.js :5 import { PrismaClient } from '@prisma/client';
db nirholas-XActions-38383aa/prisma/seed.js :1 import { PrismaClient } from '@prisma/client';
db (weak) nirholas-XActions-38383aa/scripts/gen3.js :1844 import pg from 'pg';
db nirholas-XActions-38383aa/src/agents/database.js :6 import Database from 'better-sqlite3';
db nirholas-XActions-38383aa/src/analytics/followerCRM.js :12 import Database from 'better-sqlite3';
db nirholas-XActions-38383aa/src/analytics/historyStore.js :13 import Database from 'better-sqlite3';
db nirholas-XActions-38383aa/src/client/auth/cookieImport.js :515 _Database = require('better-sqlite3');

7 more not shown — this panel samples each group; the count above is the real total.

declared dependencies 58

@modelcontextprotocol/sdk@^1.30.0
@prisma/client@^5.7.1
axios@^1.15.2
bcryptjs@^2.4.3
better-sqlite3@^11.10.0
bull@^4.12.0
chalk@^5.3.0
commander@^12.0.0
compression@^1.8.1
cors@^2.8.5
dotenv@^16.3.1
exceljs@^4.4.0

show 28 more

express@^4.21.2
express-rate-limit@^7.5.1
express-validator@^7.0.1
helmet@^7.1.0
inquirer@^9.2.0
jsonwebtoken@^9.0.2
morgan@^1.10.1
node-cron@^4.6.0
nodemailer@^9.0.3
ora@^8.0.0
prisma@^5.7.1
puppeteer@^24.34.0
puppeteer-extra@^3.3.6
puppeteer-extra-plugin-stealth@^2.11.2
redis@^4.6.11
socket.io@^4.7.5
stripe@^14.10.0
yauzl@^3.4.0
@eslint/js@^10.0.1
@remotion/bundler@^4.0.428
@remotion/cli@^4.0.428
@remotion/player@^4.0.428
@remotion/renderer@^4.0.428
@vitest/coverage-v8@^4.1.11
archiver@^5.3.2
eslint@^10.9.1
globals@^17.11.0
jsdom@^28.1.0

18 more not shown — this panel samples each group; the count above is the real total.

obfuscation 3

dynamic require()/import() nirholas-XActions-38383aa/scripts/sync-user-agents.mjs :358 committed = await import(`${pathToFileURL(out).href}?t=${Date.now()}`);
dynamic require()/import() nirholas-XActions-38383aa/scripts/sync-x-endpoints.mjs :411 const mod = await import(`${pathToFileURL(outPath).href}?t=${Date.now()}`);
dynamic require()/import() nirholas-XActions-38383aa/src/plugins/loader.js :125 mod = await import(`file://${resolved}`);

perm:untrusted 3

untrusted (weak) nirholas-XActions-38383aa/scripts/gen3.js :84 fetch(\`https://api.etherscan.io/api?module=account&action=txlist&address=\${address}&sort=asc&apikey=\${key}\`).then(r => r.json()),
untrusted (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles-2.js :209 const addr = await fetch(\`\${BASE}/address/bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh\`).then(r => r.json());
untrusted (weak) nirholas-XActions-38383aa/scripts/generate-seo-articles.js :1198 const protocols = await fetch('https://api.llama.fi/protocols').then(r => r.json());

nirholas/XActions

Drift inferred · capture-to-capture

tools

skills & prompt files 40

danger signals9

filesystem 175

shell / exec 19

network 182

secrets 118

database 47

declared dependencies 58

obfuscation 3

perm:untrusted 3

Navigate

Stream

Features

Display