The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions include curl commands and Python urllib calls to fetch API tokens and register OAuth clients via api.xpoz.ai and mcp.xpoz.ai domains.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute the mcporter CLI tool for local configuration. It passes an OAuth token retrieved from the vendor's API as an argument to this command.
[REMOTE_CODE_EXECUTION]: An automated scan flagged a pattern where data from https://mcp.xpoz.ai/oauth/token is processed and then used in a subprocess. Analysis confirms this is a standard OAuth token exchange used to configure the local environment, targeting the vendor's own infrastructure.
[SAFE]: All identified external resources, including the Python package xpoz, the NPM package @xpoz/xpoz, and the xpoz.ai subdomains, are owned and maintained by the skill's author, XPOZpublic.
[DATA_EXPOSURE]: The skill writes temporary OAuth state data to ~/.cache/xpoz-oauth/state.json. This is standard practice for state management during the authentication flow and does not target sensitive system files.

influencer-discovery