lead-generation
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the "mcporter" package from npm, which is a required utility for its operation.
- [COMMAND_EXECUTION]: The skill executes "mcporter" commands to fetch posts and users from social media platforms like Twitter, Instagram, and Reddit.
- [PROMPT_INJECTION]: The skill processes untrusted data from external social media sources, which constitutes an indirect prompt injection attack surface. Maliciously crafted posts could potentially influence the agent's scoring or outreach drafting logic. 1. Ingestion points: Social media posts and profiles fetched via mcporter from xpoz.ai. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when processing social media text. 3. Capability inventory: The skill performs local file operations in the data/ directory and network requests to mcp.xpoz.ai. 4. Sanitization: No specific filtering or sanitization of retrieved social media content is described.
Audit Metadata