The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to configure the mcporter CLI tool with OAuth access tokens.
Evidence: Found in SKILL.md within the Path A: MCP via mcporter section.
Context: The execution is restricted to adding/removing configuration for the xpoz tool using tokens retrieved from the vendor's authentication server.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install vendor-owned packages via standard registries.
Evidence: Mentions pip install xpoz and npm install @xpoz/xpoz in SKILL.md.
Context: These are official libraries for the Xpoz service authored by xpozpublic.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external social media platforms, creating a potential injection surface.
Ingestion points: Data is retrieved from Twitter and Instagram via getTwitterUsersByKeywords and getTwitterPostsByAuthor tools.
Boundary markers: The instructions do not specify explicit delimiters for social media content during the analysis phase.
Capability inventory: The skill has subprocess.run and network access (urllib.request) capabilities, primarily used for authentication.
Sanitization: No explicit sanitization of usernames or post content is described before processing.
Analysis: While the surface exists, the high-privilege capabilities (auth/config) do not use the untrusted data as input, significantly limiting the risk of exploitation.

influencer-discovery