Xpoz Social Search
v1.5.0Search Twitter, Instagram, and Reddit posts in real time. Find social media mentions, track hashtags, discover influencers, and analyze engagement — 1.5B+ posts indexed. Social listening, brand monitoring, and competitor research made easy for AI agents.
⭐ 7· 2.3k·9 current·10 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (social search across Twitter/Instagram/Reddit) matches the runtime instructions: all calls are via an mcporter CLI to Xpoz MCP endpoints. Requiring a CLI (mcporter) and an OAuth setup skill (xpoz-setup) is reasonable. Minor inconsistency: the registry summary lists no required skills or network, while SKILL.md metadata declares a dependency on xpoz-setup and network mcp.xpoz.ai — functionally coherent but the registry metadata omission is a documentation mismatch.
Instruction Scope
SKILL.md only instructs the agent to invoke the mcporter CLI to call specific xpoz.* operations, poll operation status, and use CSV export for large results. It does not instruct reading unrelated local files, environment variables, or sending data to unknown endpoints beyond the declared mcp.xpoz.ai. The setup step defers OAuth to the xpoz-setup skill (browser or device code flow), which is appropriate for acquiring tokens.
Install Mechanism
Install is an npm package (mcporter) that creates the mcporter binary. npm installs are common but execute third-party code on the host — this is moderate risk (not an arbitrary URL download). Recommend verifying the mcporter package provenance (publisher, npm page, checksum) before installing.
Credentials
The skill itself requests no environment variables or local config paths. Authentication is delegated to the xpoz-setup skill via OAuth 2.1 (expected for a SaaS integration). There are no unexplained credentials requested here.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or system-wide configuration changes. It relies on an external CLI and an auth setup skill; autonomous invocation is allowed by default but not combined with other red flags.
Assessment
This skill appears coherent with its description, but before installing: 1) Inspect the mcporter npm package (publisher, homepage, versions, download counts) — npm packages run code during install and provide the mcporter binary used at runtime. 2) Inspect the xpoz-setup skill because it handles OAuth and will obtain/store your access tokens; confirm where tokens are stored and what scopes are requested. 3) Confirm the network endpoint (mcp.xpoz.ai) is the official Xpoz service and review Xpoz's privacy/terms for data sent in queries/exports. 4) If you are cautious about autonomous agent actions, restrict the skill to user-invoked only or review agent policies, since the skill can make external network calls. If any of these provenance checks fail or are unclear, treat the install as higher risk.Like a lobster shell, security has layers — review code before you run it.
latestvk97e0hw8dvkye2wdqkhg2d85hn810cq4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsmcporter
Install
Install mcporter (npm)
Bins: mcporter
npm i -g mcporter