feat: xurl skill — cost-optimized X/Twitter via sandbox + live modes

.claude-plugin/marketplace.json

@@ -115,8 +115,8 @@
     },
     {
       "name": "fiale-awesome-skills",
-      "description": "Curated Claude Code skills for developer security and productivity — supply chain hardening across npm, Python, Go, Rust, and Homebrew (macOS)",
-      "version": "0.1.0",
+      "description": "Curated Claude Code skills — supply chain hardening (macOS) and cost-optimized X/Twitter workflows via xurl CLI with local sandbox testing",
+      "version": "0.2.0",
       "author": {
         "name": "Pavel Fadeev",
         "email": "pavel.fadeev@gmail.com",
@@ -131,7 +131,11 @@
         "hardening",
         "npm",
         "pip",
-        "macos"
+        "macos",
+        "xurl",
+        "twitter",
+        "x-api",
+        "social-media"
       ]
     },
     {

.github/workflows/pr-gate.yml

@@ -3,6 +3,10 @@ on:
   pull_request_target:
     types: [opened]
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   check-membership:
     runs-on: ubuntu-latest
@@ -13,13 +17,32 @@ jobs:
           script: |
             const { owner, repo } = context.repo;
             const author = context.payload.pull_request.user.login;
+
+            // Check if PR author is the repo owner (covers user-owned repos)
+            if (author === owner) {
+              console.log(`${author} is the repo owner — PR allowed`);
+              return;
+            }
+
+            // Check org membership (for org-owned repos)
             try {
               await github.rest.orgs.checkMembershipForUser({
                 org: owner,
                 username: author,
               });
               console.log(`${author} is an org member — PR allowed`);
-            } catch {
+            } catch (e) {
+              // Check if it's an org API error (user account, not an org) vs actual non-member
+              if (e.status === 404) {
+                // Not an org — check if author is a collaborator instead
+                try {
+                  await github.rest.repos.checkCollaborator({ owner, repo, username: author });
+                  console.log(`${author} is a collaborator — PR allowed`);
+                  return;
+                } catch {}
+              }
+
+              console.log(`${author} is not a member — closing PR`);
               await github.rest.issues.createComment({
                 owner, repo,
                 issue_number: context.payload.pull_request.number,
@@ -30,5 +53,4 @@ jobs:
                 pull_number: context.payload.pull_request.number,
                 state: 'closed',
               });
-              console.log(`${author} is not an org member — PR closed`);
             }

README.md

@@ -15,6 +15,7 @@ Plugins for [Claude Code](https://docs.anthropic.com/en/docs/claude-code).
 | [mdbrowser](#mdbrowser) | Browse any URL as clean markdown |
 | [Vibes](#vibes) | Sentiment-driven musical phrases on task completion |
 | [Remote Layout](#remote-layout) | Mobile-friendly response formatting for remote sessions |
+| [Awesome Skills](#awesome-skills) | Supply chain hardening, cost-optimized X/Twitter via xurl |
 
 ---
 
@@ -177,6 +178,28 @@ Switch Claude's response format for small screens. Persists across sessions via
 
 ---
 
+## Awesome Skills
+
+**Curated skills that turn Claude into a specialist.**
+
+Developer security and productivity skills — supply chain hardening across npm/Python/Go/Rust/Homebrew, and cost-optimized X/Twitter workflows via [xurl](https://github.com/xdevplatform/xurl) with local sandbox testing through [playground](https://github.com/xdevplatform/playground).
+
+| Skill | What it does |
+|-------|-------------|
+| `/supply-chain-hardening` | Audit and harden your macOS system against supply chain attacks |
+| `/xurl` | Post, search, engage on X/Twitter with spending guardrails and free sandbox mode |
+
+**Install:**
+```bash
+/plugin marketplace add fiale-plus/fiale-claude-plugins
+/plugin install fiale-awesome-skills
+/xurl
+```
+
+→ [Full documentation](plugins/fiale-awesome-skills)
+
+---
+
 ## License
 
 MIT

plugins/fiale-awesome-skills/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "fiale-awesome-skills",
-  "version": "0.1.0",
-  "description": "Curated Claude Code skills for developer security and productivity — supply chain hardening across npm, Python, Go, Rust, and Homebrew (macOS)",
+  "version": "0.2.0",
+  "description": "Curated Claude Code skills — supply chain hardening (macOS) and cost-optimized X/Twitter workflows via xurl CLI with local sandbox testing",
   "author": { "name": "Pavel Fadeev", "email": "pavel.fadeev@gmail.com", "url": "https://fiale.plus" },
   "license": "MIT",
-  "keywords": ["claude-code", "security", "supply-chain", "hardening", "npm", "pip", "macos"]
+  "keywords": ["claude-code", "security", "supply-chain", "hardening", "npm", "pip", "macos", "xurl", "twitter", "x-api", "social-media"]
 }

plugins/fiale-awesome-skills/README.md

@@ -4,13 +4,12 @@
 
 Curated Claude Code skills for developer security and productivity.
 
-**Platform: macOS only** (for now).
-
 ## Skills
 
 | Skill | Command | What it does |
 |-------|---------|-------------|
 | supply-chain-hardening | `/supply-chain-hardening` | Audit and harden your system against supply chain attacks across npm, Python, Go, Rust, and Homebrew |
+| xurl | `/xurl` | Cost-optimized X/Twitter workflows via xurl CLI with local sandbox testing |
 
 ## Supply Chain Hardening
 
@@ -30,12 +29,47 @@ Prompted by the axios npm RAT and LiteLLM PyPI credential stealer (both March 20
 
 All changes require user confirmation. Existing configs are backed up before modification. Rollback instructions included.
 
+## xurl
+
+Post, reply, search, and engage on X/Twitter through [xurl](https://github.com/xdevplatform/xurl) — the official X CLI — with pay-per-use cost awareness baked in.
+
+**Two operating modes:**
+
+| Mode | Cost | How |
+|------|------|-----|
+| **Sandbox** | $0 | Local [playground](https://github.com/xdevplatform/playground) server simulates the full X API v2 |
+| **Live** | Real credits | Compose → confirm → post. Spending guardrails with configurable limits |
+
+**Cost optimization features:**
+- Defaults to sandbox when playground is running — unlimited free testing
+- Cost preview: see what sandbox operations would cost before going live
+- Configurable session spending limits (default $0.25)
+- Estimated cost shown before every live write operation
+- Local session spend tracking with estimated costs per operation
+- 24h UTC deduplication awareness (same resource = 1 charge per day)
+
+**Pay-per-use pricing** (community-sourced estimates, check Developer Console for authoritative rates):
+
+| Operation | Cost |
+|-----------|------|
+| Post read | $0.005 |
+| User lookup | $0.010 |
+| Post write | $0.010 |
+| DM send | $0.015 |
+| Like / follow / repost | $0.015 |
+
+**Prerequisites:**
+- [xurl](https://github.com/xdevplatform/xurl) CLI installed (`brew install --cask xdevplatform/tap/xurl`)
+- X Developer account with app credentials (registered manually)
+- Optional: [playground](https://github.com/xdevplatform/playground) for free sandbox testing
+
 ## Install
 
 ```bash
 /plugin marketplace add fiale-plus/fiale-claude-plugins
 /plugin install fiale-awesome-skills
 /supply-chain-hardening
+/xurl
 ```
 
 ## License

plugins/fiale-awesome-skills/commands/xurl.md

@@ -0,0 +1,10 @@
+---
+name: xurl
+description: Cost-optimized X/Twitter workflows via xurl CLI with local sandbox
+---
+
+# xurl
+
+Run the xurl skill. Post, reply, search, and engage on X/Twitter with pay-per-use cost awareness. Defaults to local sandbox (playground) when available — zero cost for testing. Switches to live API on explicit request with spending guardrails and confirmation gates.
+
+Requires xurl CLI installed. Optional: playground server for free sandbox testing.