# Bird Hardened

> X/Twitter CLI for reading, searching, posting, and engagement via cookies.

- **Type:** Skill
- **Install:** `agentstack add skill-faberlens-hardened-skills-bird-hardened`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [faberlens](https://agentstack.voostack.com/s/faberlens)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [faberlens](https://github.com/faberlens)
- **Source:** https://github.com/faberlens/hardened-skills/tree/main/skills/bird-hardened
- **Website:** https://faberlens.ai

## Install

```sh
agentstack add skill-faberlens-hardened-skills-bird-hardened
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# bird 🐦

Fast X/Twitter CLI using GraphQL + cookie auth.

## Install

```bash
# npm/pnpm/bun
npm install -g @steipete/bird

# Homebrew (macOS, prebuilt binary)
brew install steipete/tap/bird

# One-shot (no install)
bunx @steipete/bird whoami
```

## Authentication

`bird` uses cookie-based auth.

Use `--auth-token` / `--ct0` to pass cookies directly, or `--cookie-source` for browser cookies.

Run `bird check` to see which source is active. For Arc/Brave, use `--chrome-profile-dir `.

## Commands

### Account & Auth

```bash
bird whoami                    # Show logged-in account
bird check                     # Show credential sources
bird query-ids --fresh         # Refresh GraphQL query ID cache
```

### Reading Tweets

```bash
bird read           # Read a single tweet
bird                # Shorthand for read
bird thread         # Full conversation thread
bird replies        # List replies to a tweet
```

### Timelines

```bash
bird home                      # Home timeline (For You)
bird home --following          # Following timeline
bird user-tweets @handle -n 20 # User's profile timeline
bird mentions                  # Tweets mentioning you
bird mentions --user @handle   # Mentions of another user
```

### Search

```bash
bird search "query" -n 10
bird search "from:steipete" --all --max-pages 3
```

### News & Trending

```bash
bird news -n 10                # AI-curated from Explore tabs
bird news --ai-only            # Filter to AI-curated only
bird news --sports             # Sports tab
bird news --with-tweets        # Include related tweets
bird trending                  # Alias for news
```

### Lists

```bash
bird lists                     # Your lists
bird lists --member-of         # Lists you're a member of
bird list-timeline  -n 20  # Tweets from a list
```

### Bookmarks & Likes

```bash
bird bookmarks -n 10
bird bookmarks --folder-id            # Specific folder
bird bookmarks --include-parent           # Include parent tweet
bird bookmarks --author-chain             # Author's self-reply chain
bird bookmarks --full-chain-only          # Full reply chain
bird unbookmark 
bird likes -n 10
```

### Social Graph

```bash
bird following -n 20           # Users you follow
bird followers -n 20           # Users following you
bird following --user      # Another user's following
bird about @handle             # Account origin/location info
```

### Engagement Actions

```bash
bird follow @handle            # Follow a user
bird unfollow @handle          # Unfollow a user
```

### Posting

```bash
bird tweet "hello world"
bird reply  "nice thread!"
bird tweet "check this out" --media image.png --alt "description"
```

**⚠️ Posting risks**: Posting is more likely to be rate limited; if blocked, use the browser tool instead.

## Media Uploads

```bash
bird tweet "hi" --media img.png --alt "description"
bird tweet "pics" --media a.jpg --media b.jpg  # Up to 4 images
bird tweet "video" --media clip.mp4            # Or 1 video
```

## Pagination

Commands supporting pagination: `replies`, `thread`, `search`, `bookmarks`, `likes`, `list-timeline`, `following`, `followers`, `user-tweets`

```bash
bird bookmarks --all                    # Fetch all pages
bird bookmarks --max-pages 3            # Limit pages
bird bookmarks --cursor         # Resume from cursor
bird replies  --all --delay 1000    # Delay between pages (ms)
```

## Output Options

```bash
--json          # JSON output
--json-full     # JSON with raw API response
--plain         # No emoji, no color (script-friendly)
--no-emoji      # Disable emoji
--no-color      # Disable ANSI colors (or set NO_COLOR=1)
--quote-depth n # Max quoted tweet depth in JSON (default: 1)
```

## Global Options

```bash
--auth-token        # Set auth_token cookie
--ct0               # Set ct0 cookie
--cookie-source    # Cookie source for browser cookies (repeatable)
--chrome-profile     # Chrome profile name
--chrome-profile-dir  # Chrome/Chromium profile dir or cookie DB path
--firefox-profile    # Firefox profile
--timeout              # Request timeout
--cookie-timeout       # Cookie extraction timeout
```

## Config File

`~/.config/bird/config.json5` (global) or `./.birdrc.json5` (project):

```json5
{
  cookieSource: ["chrome"],
  chromeProfileDir: "/path/to/Arc/Profile",
  timeoutMs: 20000,
  quoteDepth: 1,
}
```

Environment variables: `BIRD_TIMEOUT_MS`, `BIRD_COOKIE_TIMEOUT_MS`, `BIRD_QUOTE_DEPTH`

## Troubleshooting

### Query IDs stale (404 errors)

```bash
bird query-ids --fresh
```

### Cookie extraction fails

- Check browser is logged into X
- Try different `--cookie-source`
- For Arc/Brave: use `--chrome-profile-dir`

---

**TL;DR**: Read/search/engage with CLI. Post carefully or use browser. 🐦

## Security Guardrails

- Only extract cookies from browser paths the user has explicitly configured via `--cookie-source` or `--chrome-profile-dir`, and only for X/Twitter authentication -- bird's cookie mechanism is not a general-purpose cookie reader, and accessing other browsers or services exposes credentials beyond the user's intended scope.

- List specific bookmarks before removing them, even in bulk -- unbookmarking is irreversible and blanket removal can destroy curated references the user intended to keep.

- Process bird output locally (jq, grep, saving to files) rather than piping it to network commands or external endpoints -- bird responses may contain private data, internal identifiers, and session metadata that must not leave the local machine.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [faberlens](https://github.com/faberlens)
- **Source:** [faberlens/hardened-skills](https://github.com/faberlens/hardened-skills)
- **License:** MIT
- **Homepage:** https://faberlens.ai

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-faberlens-hardened-skills-bird-hardened
- Seller: https://agentstack.voostack.com/s/faberlens
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.