The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses Python's subprocess.run to configure the mcporter tool by injecting an access token retrieved from a remote OAuth endpoint (https://mcp.xpoz.ai/oauth/token). This pattern of flowing remote data directly into a shell command is a potential injection vector if the remote endpoint were compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external social media platforms (Twitter and Reddit), creating an attack surface for indirect prompt injection.
Ingestion points: getTwitterPostsByKeywords and getRedditPostsByKeywords calls in SKILL.md.
Boundary markers: Absent. The prompt templates do not use delimiters or instructions to ignore embedded commands in the social media content.
Capability inventory: subprocess.run (used for authentication configuration), file system access (reading/writing OAuth state to ~/.cache/xpoz-oauth/state.json), and network access via urllib.request.
Sanitization: Absent. The skill does not describe any filtering or escaping of the fetched social media text before analysis.
[COMMAND_EXECUTION]: The skill instructions include multiple shell commands for configuring MCP servers and environment variables, including mcporter config add, export XPOZ_API_KEY, pip install, and npm install.
[EXTERNAL_DOWNLOADS]: The skill fetches a trial API key from https://api.xpoz.ai/api/trial/token and performs OAuth registration/token exchange with https://mcp.xpoz.ai/oauth/register and https://mcp.xpoz.ai/oauth/token. These are vendor-owned endpoints used for authentication.
[REMOTE_CODE_EXECUTION]: Automated scans detected a pattern where a response from https://mcp.xpoz.ai/oauth/token is used to construct a command executed via subprocess.run. Although used for a standard OAuth flow, this involves execution based on remote data.

security-osint