xpoz-setup

• Outcome: Review
• Latest audit: Aug 26, 2026 · 1:14 PM UTC
• Version: 1.2.1

Overview

This setup skill is mostly purpose-aligned, but it automatically sends user context to Xpoz and persists authentication tokens with limited consent and scoping.

Review this before installing if you are comfortable letting the skill contact Xpoz endpoints, send task context for trial access, open or complete OAuth, and store an Xpoz bearer token in mcporter. Prefer the standard browser OAuth flow when possible, and avoid pasting authorization codes from untrusted links or modified callback URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill performs shell execution, network access, and file writes, but these capabilities are not explicitly and clearly declared in a way that enables informed consent and policy enforcement. Because the setup flow includes contacting remote services, storing OAuth state locally, and modifying mcporter configuration, underdeclared capabilities increase the risk of silent data transmission or local configuration changes without adequate visibility.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to send detailed provenance and use-case text to the trial-token endpoint, and later to perform OAuth and social-media access setup, but the description does not clearly warn that user-provided context and authentication-related data will be transmitted to Xpoz over the network. This can cause unintentional disclosure of sensitive user intent, browsing history, or task context to a third party.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The local login flow tells the user to sign in with a Google account and authorize, without presenting alternatives or clarifying whether Google is optional or merely an example. Forcing or implying a specific identity provider can pressure users into linking unrelated accounts and may violate least-surprise and informed-choice expectations.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The remote/manual OAuth flow again instructs the user to sign in with a Google account, reinforcing an unnecessary identity-provider requirement without documenting alternatives or justification. In a security-sensitive authentication setup, this reduces user agency and can result in unexpected account linkage to a third-party service.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Agent Instructions

**If you're an agent reading this, follow these steps in order. The user should not need to run any commands.**

### Step 0: Instant access (no signup needed)

• Confidence: 88% confidence
• Finding: The skill directs the agent to run shell commands, make network requests, and modify configuration with minimal user interaction, which is effectively broad tool use without per-action confirmation. In context, this is a setup skill, so such access is expected, but it remains dangerous because it can autonomously change local state and send data off-host.

Credential Access

High

• Category: Privilege Escalation

Content

Expected output: `OK: Xpoz configured successfully`

**Security notes:**
- The access token is never printed to stdout or logs
- The OAuth state file (`~/.cache/xpoz-oauth/state.json`) is automatically deleted after exchange
- Tokens are stored only in the mcporter config

• Confidence: 78% confidence
• Finding: The skill handles sensitive authentication artifacts, including an access token and OAuth code exchange, and stores resulting credentials in mcporter configuration/state. Even though the text says the token is not printed, any skill that acquires and persists bearer tokens creates meaningful credential-handling risk if logs, config stores, or downstream tools are compromised.

Static analysis

No suspicious patterns detected.