by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (social media research) matches the instructions, but there are inconsistencies in the declared requirements and a non-reviewed npm install step (mcporter) that warrants caution.
评估建议
This skill appears to do what it says (run a CLI to query an Xpoz MCP backend), but there are a few red flags to check before installing: 1) Inspect the npm package 'mcporter' (publisher, homepage, source code, recent versions) — npm packages run code on your machine. 2) Verify the xpoz-setup skill: what OAuth scopes it requests and where it stores tokens. 3) Confirm the MCP domain (mcp.xpoz.ai) and the Xpoz service (xpoz.ai) are legitimate and that using them meets platform Terms of Service (Tw...详细分析 ▾
ℹ 用途与能力
The SKILL.md describes a social intelligence platform that uses an MCP backend and a CLI (mcporter). Requiring a CLI and an Xpoz account (OAuth via xpoz-setup) is consistent with the described capabilities. However registry metadata earlier listed no credentials or network requirements while the SKILL.md's embedded metadata explicitly requires the xpoz-setup skill, network access to mcp.xpoz.ai, and an Xpoz account—this discrepancy in declared requirements is an incoherence.
✓ 指令范围
Runtime instructions are limited to calling the mcporter CLI and referring to related skills (xpoz-setup, various sub-skills). The document does not instruct the agent to read arbitrary local files or unrelated environment variables, nor to exfiltrate data to unexpected endpoints beyond the MCP server. Example commands are explicit (e.g., mcporter call xpoz.getTwitterPostsByKeywords).
⚠ 安装机制
Installation is an npm package install of 'mcporter' which will create a binary. npm installs are moderate-risk because package code executes on the host; the package author/publisher is not identified here. The install does not use a well-known release URL but uses the npm registry (expected for Node CLIs). Because no package provenance is provided and the owner/source is 'unknown', this is a point of concern.
ℹ 凭证需求
The registry entry lists no required environment variables or primary credential, but SKILL.md metadata requires an Xpoz account authenticated via the xpoz-setup skill (OAuth 2.1). Requiring an account and OAuth is proportionate to the functionality; the inconsistency between declared/actual credential requirements should be resolved before trusting the skill. No unrelated credentials or high-privilege env vars are requested in the instructions.
✓ 持久化与权限
The skill does not request always:true and does not declare writing/modifying other skills or system-wide settings. It does rely on an OAuth setup skill (xpoz-setup) to obtain access keys; review how that skill stores tokens, but the persistence/privilege level here is typical and not excessive on its own.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.12026/2/12
Added setup section, fixed dead link
● 无害
安装命令 点击复制
官方npx clawhub@latest install social-intelligence
镜像加速npx clawhub@latest install social-intelligence --registry https://cn.clawhub-mirror.com
技能文档
The complete social intelligence platform for AI agents — 1.5B+ posts across Twitter, Instagram, and Reddit.
Xpoz turns your AI agent into a social media analyst. Search posts, find experts, generate leads, monitor brands, analyze sentiment, discover influencers — all through a single MCP server.
⚡ Setup
👉 Follow xpoz-setup — one-click auth, works in 2 minutes.
Setup
Run xpoz-setup skill. Verify: mcporter call xpoz.checkAccessKeyStatus
What You Can Do
🔍 Search & Monitor
Search posts across Twitter (1B+), Instagram (400M+), and Reddit (100M+) with boolean queries, date filters, and CSV export.mcporter call xpoz.getTwitterPostsByKeywords query="your brand" startDate=2026-01-01
🎯 Find Leads
Discover people actively looking for solutions like yours — complaining about competitors, asking for recommendations, or describing pain points you solve.→ See lead-generation skill
🔬 Find Experts
Identify domain authorities, thought leaders, and practitioners by analyzing who posts about technical topics with depth and consistency.→ See expert-finder skill
📊 Analyze Sentiment
Track brand perception, compare competitors, surface recurring complaints and praise, identify viral moments.→ See social-sentiment skill
👥 Discover Influencers
Find and rank influencers by what they actually create, not just follower count. Engagement quality over vanity metrics.📦 Export Data
Every search generates a full CSV export — up to 64K rows per query. Real example: 63,936 tweets in one download (38MB).Available Skills (Install What You Need)
| Skill | Purpose | Install |
|---|---|---|
| xpoz-social-search | Core search across all platforms | clawhub install xpoz-social-search |
| expert-finder | Find domain experts & thought leaders | clawhub install expert-finder |
| social-lead-gen | Find high-intent buyers | clawhub install social-lead-gen |
| social-sentiment | Brand & sentiment analysis | clawhub install social-sentiment |
| reddit-search | Reddit-focused search | clawhub install reddit-search |
| instagram-search | Instagram-focused search | clawhub install instagram-search |
| twitter-api-alternative | Twitter data without the API | clawhub install twitter-api-alternative |
35 MCP Tools Available
Twitter (12): Search posts, find users, look up profiles, get connections, interactions, retweets, quotes, comments, post count
Instagram (9): Search posts (including reel subtitles), find users, look up profiles, get connections, interactions, comments
Reddit (8): Search posts, search comments, find users, discover subreddits, look up profiles
TikTok (5): Search posts, find users, look up profiles
Utility: Operation status polling, access key verification
Why Xpoz?
- Multi-platform — One tool for Twitter + Instagram + Reddit + TikTok
- MCP-native — Built for AI agents, not dashboards
- Natural language — Boolean queries, no coding required
- Massive scale — 1.5B+ posts, CSV exports up to 64K rows
- Affordable — Free tier available, $20/mo for full access
- 2-minute setup — No API keys, no developer accounts
Website: xpoz.ai • Free tier available
Built for ClawHub • 2026
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制