xpoz-getting-started
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install
xpoz,xpoz-cli, and@xpoz/xpoz. These are legitimate packages provided by the service for Python and Node.js environments. - [CREDENTIALS_UNSAFE]: Setup instructions include prompting the user for an API key and setting an environment variable (
XPOZ_API_KEY). No hardcoded secrets or credentials are present in the skill. - [INDIRECT_PROMPT_INJECTION]: The skill describes tools that ingest data from social media platforms (Twitter, Reddit, etc.).
- Ingestion points: Search results from social media platforms (
SKILL.md). - Boundary markers: None present in the instructions.
- Capability inventory: CLI execution via the
Bashtool. - Sanitization: None described in the skill body.
Audit Metadata