Social Sentiment

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent social-listening workflow, but users should notice that it relies on an external npm tool, Xpoz OAuth setup, network API calls, and bulk CSV storage.

Install this if you are comfortable using Xpoz, installing the mcporter npm binary, and authorizing Xpoz OAuth setup. Keep queries scoped, store CSV exports deliberately, and review or delete downloaded data when it is no longer needed.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may query Xpoz and download large CSVs, which could consume service quota and create sizable local files.

Why it was flagged

The skill exposes external API calls and bulk export operations through mcporter; this is aligned with social sentiment analysis but can retrieve large datasets.

Skill content
mcporter call xpoz.getTwitterPostsByKeywords ... Use dataDumpExportOperationId ... download URL (up to 64K rows).
Recommendation

Use specific keywords, date ranges, and platforms; review downloaded CSVs before sharing or reusing them.

What this means

Using the skill may authenticate the agent to an Xpoz account and use that account's access or quota for searches and exports.

Why it was flagged

The skill requires delegated Xpoz account authentication, which is expected for this integration but should be understood before use.

Skill content
"credentials": "Xpoz account (free tier) — auth via xpoz-setup skill (OAuth 2.1)"
Recommendation

Authorize only the intended Xpoz account and review the xpoz-setup flow before granting OAuth access.

What this means

Installing the skill adds a local binary from npm that will be used to call the Xpoz service.

Why it was flagged

The skill depends on an external npm package that provides the mcporter binary; this is central to the workflow but requires trusting that package source.

Skill content
node | package: mcporter | creates binaries: mcporter
Recommendation

Install from the expected registry, verify the package publisher/version when possible, and review any referenced setup skill before authorizing it.

What this means

Bulk social post data may remain on disk and be reused in future analyses or reports.

Why it was flagged

The skill encourages persistent storage and later reuse of retrieved social-media content; this is useful for trends but should be treated as untrusted data.

Skill content
Download full CSVs | Reddit = honest | Store `data/social-sentiment/` for trends
Recommendation

Store exports in an intentional location, apply retention or deletion practices, and treat post text as data to analyze rather than instructions to follow.