lead-gen-scan
Fail
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches authentication tokens and trial keys from vendor-owned domains (
api.xpoz.ai,mcp.xpoz.ai). These are standard credential management operations for the service. - [COMMAND_EXECUTION]: The skill uses
subprocess.runand themcporterCLI tool to configure authentication. This involves passing a token fetched from a remote endpoint into a local command as an argument. The implementation uses list-based arguments which prevents shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from social media platforms (Reddit, Twitter/X, Instagram, and TikTok) to identify leads, creating a surface for indirect prompt injection.
- Ingestion points: Data retrieved through tools like
getRedditPostsByKeywordsandgetTwitterPostsByKeywordsas described inSKILL.md. - Boundary markers: Not explicitly defined for the ingested social media content; the agent is instructed to manually qualify and prioritize the leads.
- Capability inventory: The skill possesses capabilities for network access (
urllib.request), file system writes (~/.cache/xpoz-oauth/state.json), and subprocess execution (mcporter) as defined inSKILL.md. - Sanitization: None mentioned; the instructions rely on human oversight for the final engagement.
Recommendations
- HIGH: Downloads and executes remote code from: https://mcp.xpoz.ai/oauth/token - DO NOT USE without thorough review
Audit Metadata