The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and shell commands (curl, export) to configure the environment and authenticate with the Xpoz service. These operations are restricted to setup procedures and interact with the vendor's official CLI tools (mcporter).
[EXTERNAL_DOWNLOADS]: Fetches trial API keys and authentication tokens from api.xpoz.ai and mcp.xpoz.ai. It also references official vendor libraries (xpoz for Python and @xpoz/xpoz for Node.js). All downloads originate from the vendor's official infrastructure or trusted package registries.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted social media content from platforms like Twitter and Reddit.
Ingestion points: Data enters through getTwitterPostsByKeywords, getRedditPostsByKeywords, and SDK search methods in SKILL.md.
Boundary markers: No specific boundary markers (e.g., XML tags) are used to encapsulate the retrieved social media text within the analysis prompts.
Capability inventory: The agent has access to subprocess execution (for configuration) and network operations (for API calls).
Sanitization: Content is parsed for metrics (sentiment, engagement) but no explicit sanitization for embedded instructions is implemented.
[REMOTE_CODE_EXECUTION]: Analysis of the automated scan alert regarding the OAuth token exchange confirms it is a standard implementation of the OAuth 2.0 protocol. The process involves retrieving an access token from the vendor's endpoint and passing it as a configuration argument, which is a legitimate and safe pattern for service authentication.

competitive-intel