Lead Generation — Find high-intent buyers in live Twitter, Instagram, and Reddit conversations. Auto-researches your product, generates targeted search queries, and discovers people actively looking for solutions you offer. Social selling and prospecting powered by 1.5B+ indexed posts via Xpoz MCP.
Security Analysis
medium confidenceThe skill's requirements and runtime instructions match a social-leads workflow (it calls a CLI that talks to Xpoz's MCP, asks for OAuth via an auxiliary setup skill, and stores search/profile artifacts), but it installs an npm package and will store lead data locally so you should review those before installing.
Name/description (social lead discovery via Xpoz MCP) aligns with required binary (mcporter), the declared network host (mcp.xpoz.ai) and the SKILL.md calls (mcporter call xpoz.*). The dependency on an xpoz-setup skill for OAuth is coherent with needing user authorization to query Xpoz.
Instructions stay within the stated purpose (product research via web_search/web_fetch, generate queries, call mcporter to fetch platform posts, score and deduplicate, produce outreach drafts). They instruct the agent to write files under data/lead-generation and to use web fetching for product research — both reasonable for this task but worth noting because they create local artifacts and cause the agent to fetch external webpages.
Install spec uses npm to install a package named 'mcporter' which provides the mcporter binary. npm installs are common but carry moderate risk because published packages can contain arbitrary code; there are no direct downloads from untrusted URLs or archives, but you should verify the package's provenance (npm page, GitHub repo, maintainer) before installing.
The skill does not request unrelated environment variables or credentials in its manifest. Authentication is delegated to an xpoz-setup skill (OAuth 2.1), which is proportionate for a service that queries social/post index data.
always:false (no forced global persistence). The skill will write persistent artifacts (product-profile.json, search-queries.json, sent-leads.json) under data/lead-generation and may be invoked autonomously by the agent (default). Consider that stored lead lists may contain personal data and that autonomous invocation + network access increases operational risk if you don't trust the mcporter package or Xpoz service.
Guidance
Before installing: 1) Inspect the 'mcporter' npm package (npmjs page, GitHub source, recent maintainer activity) to ensure it comes from a trusted publisher. 2) Confirm xpoz-setup's OAuth flow and what tokens/permissions it grants; avoid providing unrelated credentials. 3) Be aware the skill will save lead data locally under data/lead-generation—plan for sensitive-data handling, retention, and deletion. 4) Consider legal/compliance implications of scraping/engaging users on social platforms and the content of outreach messages (spam/GDPR). 5) If possible, test in an isolated environment or sandbox and limit autonomous invocation until you trust the package and remote host (mcp.xpoz.ai).
Latest Release
v2.2.0
Added setup section
More by @atyachin
Published by @atyachin on ClawHub
