Instagram Search

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is coherent for Instagram search through Xpoz, with disclosed third-party CLI installation, Xpoz OAuth setup, and Xpoz MCP network use that users should understand before installing.

Before installing, make sure you trust Xpoz and the mcporter npm package, understand that searches are sent to Xpoz MCP, and review any CSV exports before sharing them.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may install and use the mcporter CLI from npm.

Why it was flagged

The skill relies on installing a third-party npm CLI package. This is expected for the Xpoz MCP workflow, but it is still a supply-chain dependency users should trust before installation.

Skill content

node | package: mcporter | creates binaries: mcporter

Recommendation

Install only if you trust the mcporter package and the Xpoz service provider.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent may use your Xpoz account authorization to run searches through Xpoz.

Why it was flagged

The skill requires an Xpoz account and OAuth setup. This is purpose-aligned for accessing Xpoz search services and does not request Instagram or Meta credentials.

Skill content

Xpoz account (free tier) — auth via xpoz-setup skill (OAuth 2.1)

Recommendation

Complete OAuth setup only if you intend to let the agent use your Xpoz account, and review any account limits or billing terms.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Your search queries and returned export workflow are processed by Xpoz rather than staying entirely local.

Why it was flagged

Search requests and results are handled through an external Xpoz MCP service, which is disclosed and central to the skill's purpose.

Skill content

works through Xpoz MCP

Recommendation

Avoid sending sensitive research terms unless you are comfortable sharing them with Xpoz.

Info

#ASI02: Tool Misuse and Exploitation

What this means

Searches can produce large downloadable datasets through Xpoz.

Why it was flagged

The skill can generate sizable CSV exports from Instagram search results. This is disclosed and purpose-aligned, but users should be aware of the volume of data produced.

Skill content

Every search generates a full export. Poll the `dataDumpExportOperationId` for a CSV download URL (up to 64K rows).

Recommendation

Review intended queries and exports before using or sharing generated CSV data.