Xpoz Social Search

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Xpoz social-media search integration, with the main considerations being its external Xpoz OAuth/MCP setup and npm/helper-skill dependencies.

Install only if you trust Xpoz, mcporter, and the xpoz-setup skill. Expect your search terms and requested results to be sent to Xpoz MCP and to count against your Xpoz account quota.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent will operate through the user's authorized Xpoz account and may consume that account's search quota.

Why it was flagged

The skill requires an Xpoz account authorization. This is expected for an Xpoz social-search integration, but it is still account-level access the user should understand before authorizing.

Skill content

"credentials": "Xpoz account (free tier) — auth via xpoz-setup skill (OAuth 2.1)"

Recommendation

Authorize only the intended Xpoz account and review the Xpoz setup flow before granting access.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or using the skill relies on external package and setup components outside this instruction-only artifact.

Why it was flagged

The skill depends on an npm-installed binary and a separate setup skill. These dependencies are disclosed and relevant to the purpose, but users must trust those external components.

Skill content

"requires": { "bins": ["mcporter"], "skills": ["xpoz-setup"], "network": ["mcp.xpoz.ai"] ... }, "install": [{"kind": "node", "package": "mcporter" ...}]

Recommendation

Install from the expected source and review the xpoz-setup skill and mcporter package provenance if dependency trust is important.

Info

#ASI02: Tool Misuse and Exploitation

What this means

The agent may request sizable social-media datasets from Xpoz and consume search/export quota.

Why it was flagged

The skill can retrieve and export social-search results at scale. This is aligned with social listening and research, but users should notice the volume and external-service usage.

Skill content

**CSV export:** Use `dataDumpExportOperationId` from search, poll for URL (up to 64K rows).

Recommendation

Use clear user-directed queries, limits, and fields, and avoid sending sensitive business research terms unless appropriate.