Fix Xquik extraction approval boundaries 🤖🤖🤖

[kriptoburak]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Closes #2745.

The accepted Xquik Skill classified follower exports as low-risk reads. Current Xquik and TweetClaw contracts run complete exports through metered extraction jobs that require an estimate and explicit approval.

This update:

• Requires an estimate and approval before extraction-backed exports.
• Separates bounded public reads from private, paid, recurring, and persistent work.
• Documents the current MCP endpoint, OAuth preference, and two-tool discovery flow.
• Adds webhook confirmation and untrusted-content boundaries.

It updates the existing Skill only. It does not add a catalog entry or promotional resource.

---

Type of Contribution

• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.

---

Validation

• npm run skill:validate (410 Skills passed)
• npx --yes @microsoft/vally-cli lint skills/x-twitter-scraper --verbose (2/2 checks passed)
• npm run plugin:validate (93 plugins passed; existing external-catalog warnings only)
• npm start (generated files already current)
• bash eng/fix-line-endings.sh
• git diff --check

Additional Notes

I am affiliated with Xquik. This correction is limited to practical runtime and approval behavior in the already accepted Skill. Xquik remains a paid service with documented public-read and metered-operation boundaries.

Prepared with Codex. I reviewed the issue, source contracts, repository rules, generated output, and final diff, and I take responsibility for the contribution.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ x-twitter-scraper (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/x-twitter-scraper
✅ x-twitter-scraper (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed