xpoz-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches content from external social media platforms (Twitter, Instagram, Reddit, TikTok), which serves as an ingestion point for untrusted data. This creates a surface for indirect prompt injection where malicious instructions embedded in social media posts could attempt to influence the agent's behavior. \n
- Ingestion points: Data retrieval tools defined in
SKILL.mdand reference files (e.g.,getTwitterPostsByKeywords). \n - Boundary markers: The instructions do not define delimiters or specific safety markers to differentiate untrusted social media content from system instructions. \n
- Capability inventory: The skill is configured to use the
Bash(xpoz-cli *)tool, which provides a command execution path. \n - Sanitization: There are no explicit instructions for the agent to sanitize or validate the external content before processing. \n- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
xpoz,xpoz-cli, and@xpoz/xpozpackages. These are legitimate resources provided by the vendorxpozpublic. \n- [COMMAND_EXECUTION]: The skill uses theBashtool to executexpoz-clicommands for retrieving and managing social media data.
Audit Metadata