Instagram Search
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: instagram-search Version: 1.1.1 The skill bundle is benign. All instructions in `SKILL.md` are consistent with its stated purpose of providing Instagram search functionality via the Xpoz.ai platform. It instructs the agent to install the `mcporter` binary via `npm` and use it to interact with the `xpoz` service. There are no signs of prompt injection, data exfiltration beyond expected search results, persistence mechanisms, or other malicious behaviors. The external dependencies (`mcporter` and `xpoz.ai`) are explicitly declared and align with the skill's description.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill may install and use the mcporter CLI from npm.
The skill relies on installing a third-party npm CLI package. This is expected for the Xpoz MCP workflow, but it is still a supply-chain dependency users should trust before installation.
node | package: mcporter | creates binaries: mcporter
Install only if you trust the mcporter package and the Xpoz service provider.
The agent may use your Xpoz account authorization to run searches through Xpoz.
The skill requires an Xpoz account and OAuth setup. This is purpose-aligned for accessing Xpoz search services and does not request Instagram or Meta credentials.
Xpoz account (free tier) — auth via xpoz-setup skill (OAuth 2.1)
Complete OAuth setup only if you intend to let the agent use your Xpoz account, and review any account limits or billing terms.
Your search queries and returned export workflow are processed by Xpoz rather than staying entirely local.
Search requests and results are handled through an external Xpoz MCP service, which is disclosed and central to the skill's purpose.
works through Xpoz MCP
Avoid sending sensitive research terms unless you are comfortable sharing them with Xpoz.
Searches can produce large downloadable datasets through Xpoz.
The skill can generate sizable CSV exports from Instagram search results. This is disclosed and purpose-aligned, but users should be aware of the volume of data produced.
Every search generates a full export. Poll the `dataDumpExportOperationId` for a CSV download URL (up to 64K rows).
Review intended queries and exports before using or sharing generated CSV data.