{"id":"1c0286ec-8917-4881-927c-5180f7f97f38","shortId":"vC4Aqr","kind":"skill","title":"security-osint","tagline":"Monitor social platforms for security threats, vulnerability discussions, and breach intelligence using Xpoz. Use when asked to \"find CVE discussions\", \"security threat monitoring\", \"OSINT social media\", \"vulnerability intelligence\", \"breach mentions\", or \"threat intel from Twitt","description":"# Security OSINT\n\n## Overview\n\nMonitor Twitter/X and Reddit for security-related discussions — CVE mentions, zero-day chatter, breach reports, exploit code sharing, and emerging threats. Provides early warning intelligence often 24-48 hours before formal advisories.\n\n## When to Use\n\nActivate when the user asks:\n- \"Find discussions about [CVE-XXXX-XXXXX] on Twitter\"\n- \"What's the security community saying about [VULNERABILITY]?\"\n- \"Monitor social media for [SOFTWARE] vulnerabilities\"\n- \"OSINT research on [THREAT ACTOR/CAMPAIGN]\"\n- \"Are there breach reports about [COMPANY] on social media?\"\n- \"Threat intelligence from Twitter and Reddit\"\n\n## Setup & Authentication\n\nBefore fetching data, ensure Xpoz access is configured. Follow these checks in order.\n\n### Check 1: Already authenticated?\n\n**If you have MCP tools**, try calling any Xpoz tool (e.g., `checkAccessKeyStatus`). If it works → skip to Step 1.\n\n**If you have the SDK**, try:\n```python\nfrom xpoz import XpozClient\nclient = XpozClient()  # reads XPOZ_API_KEY env var\n```\nIf this succeeds without error → skip to Step 1.\n\nIf neither works, you need to authenticate. Choose the path that fits your environment:\n\n---\n\n### Path A: MCP via mcporter (OpenClaw agents)\n\nIf `mcporter` is available:\n\n```bash\nmcporter call xpoz.checkAccessKeyStatus\n```\n\nIf `hasAccessKey: true` → ready. If not:\n\n```bash\nmcporter config add xpoz https://mcp.xpoz.ai/mcp --auth oauth\n```\n\nThen authenticate — generate the OAuth URL and send it to the user:\n\n**Step 1: Generate authorization URL**\n```python\nimport secrets, hashlib, base64, urllib.parse, json, urllib.request, os\n\nverifier = secrets.token_urlsafe(64)\nchallenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b'=').decode()\nstate = secrets.token_urlsafe(32)\n\n# Dynamic client registration\nreg_req = urllib.request.Request(\n    'https://mcp.xpoz.ai/oauth/register',\n    data=json.dumps({\n        'client_name': 'Agent Skills',\n        'redirect_uris': ['https://www.xpoz.ai/oauth/openclaw'],\n        'grant_types': ['authorization_code'],\n        'response_types': ['code'],\n        'token_endpoint_auth_method': 'none',\n    }).encode(),\n    headers={'Content-Type': 'application/json'},\n)\nreg_resp = json.loads(urllib.request.urlopen(reg_req).read())\n\nparams = urllib.parse.urlencode({\n    'response_type': 'code',\n    'client_id': reg_resp['client_id'],\n    'code_challenge': challenge,\n    'code_challenge_method': 'S256',\n    'redirect_uri': 'https://www.xpoz.ai/oauth/openclaw',\n    'state': state,\n    'scope': 'mcp:tools',\n    'resource': 'https://mcp.xpoz.ai/',\n})\n\nauth_url = 'https://mcp.xpoz.ai/oauth/authorize?' + params\n\n# Save state for token exchange\nos.makedirs(os.path.expanduser('~/.cache/xpoz-oauth'), exist_ok=True)\nwith open(os.path.expanduser('~/.cache/xpoz-oauth/state.json'), 'w') as f:\n    json.dump({'verifier': verifier, 'state': state, 'client_id': reg_resp['client_id'],\n               'redirect_uri': 'https://www.xpoz.ai/oauth/openclaw'}, f)\n\nprint(auth_url)\n```\n\n**Step 2: Send the URL to the user**\n\nTell them:\n> \"I need to connect to Xpoz for social media data. Please open this link and sign in:\n>\n> [auth_url]\n>\n> After authorizing, you'll see a code. Paste it back to me here.\"\n\n**Step 3: WAIT for the user to reply with the code.** Do not proceed until they respond.\n\n**Step 4: Exchange the code for a token**\n\nOnce the user provides the code (either a raw code or a URL containing `?code=...`), extract the code and exchange it:\n\n```python\nimport json, urllib.request, urllib.parse, subprocess, os\n\nwith open(os.path.expanduser('~/.cache/xpoz-oauth/state.json')) as f:\n    oauth = json.load(f)\n\ncode = \"THE_CODE_FROM_USER\"  # Extract from user's reply\n\ndata = urllib.parse.urlencode({\n    'grant_type': 'authorization_code',\n    'code': code,\n    'redirect_uri': oauth['redirect_uri'],\n    'client_id': oauth['client_id'],\n    'code_verifier': oauth['verifier'],\n}).encode()\n\nreq = urllib.request.Request(\n    'https://mcp.xpoz.ai/oauth/token',\n    data=data,\n    headers={'Content-Type': 'application/x-www-form-urlencoded'},\n)\nresp = json.loads(urllib.request.urlopen(req).read())\ntoken = resp['access_token']\n\n# Configure mcporter with the token (token is never printed)\nsubprocess.run(['mcporter', 'config', 'remove', 'xpoz'], capture_output=True)\nsubprocess.run(['mcporter', 'config', 'add', 'xpoz', 'https://mcp.xpoz.ai/mcp',\n                '--header', f'Authorization=Bearer {token}'], check=True)\n\n# Clean up\nos.remove(os.path.expanduser('~/.cache/xpoz-oauth/state.json'))\nprint(\"Xpoz configured successfully\")\n```\n\n**Step 5: Verify** with `mcporter call xpoz.checkAccessKeyStatus` → should return `hasAccessKey: true`.\n\n---\n\n### Path B: MCP via Claude Code config\n\nFor Claude Code users without mcporter, add to `~/.claude.json`:\n```json\n{\n  \"mcpServers\": {\n    \"xpoz\": {\n      \"url\": \"https://mcp.xpoz.ai/mcp\",\n      \"transport\": \"http-stream\"\n    }\n  }\n}\n```\nClaude Code handles OAuth automatically on first tool call — the user just needs to authorize in their browser when prompted.\n\n---\n\n### Path C: SDK (Python or TypeScript)\n\nAsk the user:\n> \"I need a Xpoz API key to access social media data. Please go to https://xpoz.ai/get-token (it's free, no credit card needed) and paste the key back to me.\"\n\n**WAIT for the user to reply with the key.** Then:\n\n**Python:**\n```bash\npip install xpoz\n```\n```python\nfrom xpoz import XpozClient\nclient = XpozClient(\"THE_KEY_FROM_USER\")\n```\n\n**TypeScript:**\n```bash\nnpm install @xpoz/xpoz\n```\n```typescript\nimport { XpozClient } from \"@xpoz/xpoz\";\nconst client = new XpozClient({ apiKey: \"THE_KEY_FROM_USER\" });\nawait client.connect();\n```\n\nOr set the environment variable and use the default constructor:\n```bash\nexport XPOZ_API_KEY=THE_KEY_FROM_USER\n```\n\n---\n\n### Auth Errors\n| Problem | Solution |\n|---------|----------|\n| MCP: \"Unauthorized\" | Re-run the OAuth flow above |\n| SDK: `AuthenticationError` | Verify key at [xpoz.ai/settings](https://xpoz.ai/settings) |\n| Token exchange fails | Ask user to re-authorize — codes are single-use |\n\n\n## Step-by-Step Instructions\n\n### Step 1: Parse the Request\n\nExtract:\n- **Target**: CVE ID, software name, company, threat actor, or general topic\n- **Scope**: specific vulnerability vs broad monitoring\n- **Platforms** (default: Twitter + Reddit — where security researchers are most active)\n- **Time period** (default: last 7 days; use 24-48h for breaking threats)\n\nBuild targeted queries:\n\n**For a specific CVE:**\n```\n\"CVE-2026-1234\" OR \"CVE202612345\"\n```\n\n**For a software vulnerability:**\n```\n(\"[SOFTWARE]\" AND (\"vulnerability\" OR \"vuln\" OR \"exploit\" OR \"RCE\" OR \"zero-day\" OR \"0day\" OR \"CVE\"))\n```\n\n**For breach monitoring:**\n```\n(\"[COMPANY]\" AND (\"breach\" OR \"hacked\" OR \"leak\" OR \"data leak\" OR \"compromised\" OR \"ransomware\"))\n```\n\n**For threat actor tracking:**\n```\n(\"[THREAT ACTOR]\" OR \"[KNOWN ALIASES]\") AND (\"attack\" OR \"campaign\" OR \"APT\" OR \"malware\")\n```\n\n### Step 2: Fetch Security Discussions\n\n#### Via MCP\n\n**Twitter (security researchers are very active here):**\n```\nCall getTwitterPostsByKeywords:\n  query: \"<security query>\"\n  fields: [\"id\", \"text\", \"authorUsername\", \"createdAtDate\", \"likeCount\", \"retweetCount\", \"impressionCount\"]\n  startDate: \"<7 days ago, YYYY-MM-DD>\"\n  endDate: \"<today, YYYY-MM-DD>\"\n  language: \"en\"\n```\n\n**Find security researchers discussing the topic:**\n```\nCall getTwitterUsersByKeywords:\n  query: \"<security query>\"\n  fields: [\"id\", \"username\", \"name\", \"description\", \"followersCount\", \"relevantTweetsCount\", \"relevantTweetsLikesSum\", \"verified\"]\n  startDate: \"<7 days ago>\"\n```\n\n**Reddit (r/netsec, r/cybersecurity, r/hacking, etc.):**\n```\nCall getRedditPostsByKeywords:\n  query: \"<security query>\"\n  fields: [\"id\", \"title\", \"text\", \"authorUsername\", \"createdAtDate\", \"score\", \"numComments\", \"subreddit\", \"url\"]\n  startDate: \"<7 days ago>\"\n```\n\n**CRITICAL:** Poll `checkOperationStatus` with each `operationId` until \"completed\".\n\n#### Via Python SDK\n\n```python\nfrom xpoz import XpozClient\n\nclient = XpozClient()\n\ncve_id = \"CVE-2026-1234\"\nquery = f'\"{cve_id}\"'\n\n# Twitter - security researcher chatter\ntwitter_posts = client.twitter.search_posts(\n    query,\n    start_date=\"2026-02-16\",\n    end_date=\"2026-02-23\",\n    fields=[\"id\", \"text\", \"author_username\", \"created_at_date\", \"like_count\", \"retweet_count\", \"impression_count\"]\n)\n\n# Find researchers discussing it\nresearchers = client.twitter.get_users_by_keywords(\n    query,\n    start_date=\"2026-02-16\",\n    fields=[\"username\", \"name\", \"description\", \"followers_count\", \"relevant_tweets_count\", \"verified\"]\n)\n\n# Reddit - deeper technical discussions\nreddit_posts = client.reddit.search_posts(\n    query,\n    start_date=\"2026-02-16\",\n    fields=[\"id\", \"title\", \"text\", \"author_username\", \"created_at_date\", \"score\", \"num_comments\", \"subreddit\", \"url\"]\n)\n\nprint(f\"Twitter: {twitter_posts.pagination.total_rows} posts\")\nprint(f\"Reddit: {reddit_posts.pagination.total_rows} posts\")\nprint(f\"Researchers: {researchers.pagination.total_rows} users\")\n\n# Export for analysis\ntwitter_csv = twitter_posts.export_csv()\nreddit_csv = reddit_posts.export_csv()\n\nclient.close()\n```\n\n#### Via TypeScript SDK\n\n```typescript\nimport { XpozClient } from \"@xpoz/xpoz\";\n\nconst client = new XpozClient();\nawait client.connect();\n\nconst cveId = \"CVE-2026-1234\";\n\nconst twitterPosts = await client.twitter.searchPosts(`\"${cveId}\"`, {\n  startDate: \"2026-02-16\",\n  endDate: \"2026-02-23\",\n  fields: [\"id\", \"text\", \"authorUsername\", \"createdAtDate\", \"likeCount\", \"retweetCount\"],\n});\n\nconst redditPosts = await client.reddit.searchPosts(`\"${cveId}\"`, {\n  startDate: \"2026-02-16\",\n  fields: [\"id\", \"title\", \"text\", \"score\", \"numComments\", \"subreddit\"],\n});\n\nawait client.close();\n```\n\n### Step 3: Analyze Threat Intelligence\n\n**Timeline Reconstruction:**\n- Sort all posts chronologically\n- Identify the first public mention (potential disclosure date)\n- Track how discussion evolved (initial report → PoC → exploitation → patches)\n\n**Severity Assessment (from social signals):**\n| Signal | Indicates |\n|--------|-----------|\n| High engagement + rapid spread | Critical/actively exploited |\n| Security researchers sharing PoC code | Weaponization in progress |\n| Vendor accounts responding | Acknowledged, patch likely coming |\n| Low volume, technical-only discussion | Early stage or low severity |\n| Mentions of \"in the wild\" / \"actively exploited\" | Immediate action needed |\n\n**Source Credibility:**\n- Verified security researchers (check bio for \"security\", \"pentest\", \"CISO\", \"CVE\")\n- High follower count in security niche\n- Posted from known security company accounts\n- Cross-referenced across multiple independent sources\n\n**Key Information to Extract:**\n- Affected software/versions\n- Attack vector (remote/local, authentication required?)\n- Exploit availability (PoC published?)\n- Patch status (fixed? workaround available?)\n- Active exploitation reports\n- IoCs (indicators of compromise) shared\n\n### Step 4: Generate Report\n\n```\n## Security Intelligence: [TARGET]\n**Period:** [date range] | **Sources:** Twitter ([X] posts), Reddit ([X] posts)\n\n### ⚠️ Threat Summary\n**Severity:** Critical / High / Medium / Low\n**Status:** [Active exploitation / PoC available / Discussion only / Patched]\n**First seen:** [date of earliest social mention]\n\n### Timeline\n| Date | Source | Event |\n|------|--------|-------|\n| Feb 16 | Twitter @researcher | First public mention of vulnerability |\n| Feb 17 | Reddit r/netsec | Technical analysis posted |\n| Feb 18 | Twitter @vendor | Patch announced |\n\n### Technical Details (from social sources)\n- **Affected:** [software, versions]\n- **Vector:** [remote/local, auth requirements]\n- **Impact:** [RCE, data leak, DoS, etc.]\n- **Exploit:** [PoC available? Where?]\n- **Patch:** [Available? Version? Workaround?]\n\n### Key Voices\n| Researcher | Followers | Posts | Credibility |\n|-----------|-----------|-------|-------------|\n| @security_expert | 50K | 3 | High (CISO at [company]) |\n| ... | ... | ... | ... |\n\n### Notable Posts\n> \"Actual quote from security researcher\" — @username (❤️ X, 🔁 X)\n\n### Subreddit Activity\n| Subreddit | Posts | Top Thread |\n|-----------|-------|-----------|\n| r/netsec | X | \"Title...\" (⬆️ X, 💬 X) |\n| r/cybersecurity | X | \"Title...\" |\n\n### Recommended Actions\n1. [Immediate: patch/mitigate if affected]\n2. [Monitor: watch for exploitation reports]\n3. [Investigate: check logs for IoCs]\n```\n\n## Example Prompts\n\n- \"What's the security community saying about CVE-2026-1234?\"\n- \"Monitor Twitter for Log4Shell discussions in the last 48 hours\"\n- \"OSINT: find breach reports about [Company] on social media\"\n- \"Are there any zero-day discussions about Chrome this week?\"\n- \"Track discussions about the latest ransomware campaign on Twitter and Reddit\"\n- \"Find security researchers talking about MCP server vulnerabilities\"\n\n## Notes\n\n- Security discussions on Twitter often precede formal CVE publication by 24-48 hours\n- Reddit r/netsec and r/cybersecurity provide technical depth; Twitter provides speed\n- Use `relevantTweetsCount` from user search to find who's most actively discussing a threat\n- Be careful with sensitive information — don't amplify exploit code or IoCs unnecessarily\n- Free tier: 100K results/month at [xpoz.ai](https://xpoz.ai?utm_source=github&utm_medium=agent-skills&utm_campaign=security-osint)","tags":["security","osint","xpoz","agent","skills","xpozpublic","agent-skills","ai-agents","claude-code","claude-code-skills","claude-skills","codex-cli"],"capabilities":["skill","source-xpozpublic","skill-security-osint","topic-agent-skills","topic-ai-agents","topic-claude-code","topic-claude-code-skills","topic-claude-skills","topic-codex-cli","topic-mcp","topic-reddit-api","topic-skill-md","topic-skillsmp","topic-social-intelligence","topic-social-media"],"categories":["xpoz-agent-skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/XPOZpublic/xpoz-agent-skills/security-osint","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add XPOZpublic/xpoz-agent-skills","source_repo":"https://github.com/XPOZpublic/xpoz-agent-skills","install_from":"skills.sh"}},"qualityScore":"0.455","qualityRationale":"deterministic score 0.46 from registry signals: · indexed on github topic:agent-skills · 10 github stars · SKILL.md body (13,330 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T19:08:21.931Z","embedding":null,"createdAt":"2026-04-23T13:04:17.606Z","updatedAt":"2026-05-18T19:08:21.931Z","lastSeenAt":"2026-05-18T19:08:21.931Z","tsv":"'-02':1042,1047,1076,1100,1172,1176,1192 '-1234':860,1025,1164,1498 '-16':1043,1077,1101,1173,1193 '-2026':859,1024,1163,1497 '-23':1048,1177 '-48':71,846,1560 '/'',':357 '/.cache/xpoz-oauth':371 '/.cache/xpoz-oauth/state.json':378,500,596 '/.claude.json':627 '/get-token':684 '/mcp':235,634 '/mcp'',':584 '/oauth/authorize?''':362 '/oauth/openclaw''':397 '/oauth/openclaw'',':348 '/oauth/openclaw''],':300 '/oauth/register'',':289 '/oauth/token'',':543 '/settings](https://xpoz.ai/settings)':785 '0day':881 '1':143,164,192,251,806,1470 '100k':1601 '16':1383 '17':1392 '18':1399 '2':403,919,1475 '2026':1041,1046,1075,1099,1171,1175,1191 '24':70,845,1559 '3':445,1204,1439,1481 '32':280 '4':462,1340 '48':1507 '5':602 '50k':1438 '64':267 '7':842,944,978,1000 'access':134,558,675 'account':1253,1303 'acknowledg':1255 'across':1307 'action':1278,1469 'activ':79,837,930,1275,1331,1364,1455,1582 'actor':818,903,906 'actor/campaign':111 'actual':1446 'add':231,580,625 'advisori':75 'affect':1315,1409,1474 'agent':213,294,1612 'agent-skil':1611 'ago':946,980,1002 'alias':909 'alreadi':144 'amplifi':1593 'analysi':1136,1396 'analyz':1205 'announc':1403 'api':180,672,759 'apikey':739 'application/json':318 'application/x-www-form-urlencoded':550 'apt':915 'ask':19,83,665,789 'assess':1232 'attack':911,1317 'auth':236,310,358,400,429,765,1414 'authent':128,145,199,239,1320 'authenticationerror':779 'author':253,303,432,520,587,653,794,1052,1106 'authorusernam':938,993,1181 'automat':643 'avail':217,1323,1330,1367,1424,1427 'await':744,1158,1167,1187,1201 'b':275,613 'b64encode':270 'back':440,696 'base64':259 'base64.urlsafe':269 'bash':218,228,710,726,756 'bearer':588 'bio':1286 'breach':13,32,57,114,885,889,1511 'break':849 'broad':826 'browser':656 'build':851 'c':660 'call':152,220,606,647,932,965,986 'campaign':913,1535,1615 'captur':574 'card':690 'care':1587 'challeng':268,338,339,341 'chatter':56,1033 'check':139,142,590,1285,1483 'checkaccesskeystatus':157 'checkoperationstatus':1005 'choos':200 'chrome':1526 'chronolog':1213 'ciso':1290,1441 'claud':616,620,639 'clean':592 'client':176,282,292,331,335,387,391,529,532,719,736,1019,1155 'client.close':1145,1202 'client.connect':745,1159 'client.reddit.search':1094 'client.reddit.searchposts':1188 'client.twitter.get':1068 'client.twitter.search':1036 'client.twitter.searchposts':1168 'code':60,304,307,330,337,340,437,454,465,474,478,483,486,506,508,521,522,523,534,617,621,640,795,1248,1595 'come':1258 'comment':1113 'communiti':97,1493 'compani':117,816,887,1302,1443,1514 'complet':1010 'compromis':898,1337 'config':230,571,579,618 'configur':136,560,599 'connect':415 'const':735,1154,1160,1165,1185 'constructor':755 'contain':482 'content':316,548 'content-typ':315,547 'count':1058,1060,1062,1083,1086,1294 'creat':1054,1108 'createdatd':939,994,1182 'credibl':1281,1435 'credit':689 'critic':1003,1359 'critical/actively':1242 'cross':1305 'cross-referenc':1304 'csv':1138,1140,1142,1144 'cve':22,51,88,812,857,858,883,1021,1023,1028,1162,1291,1496,1556 'cve-xxxx-xxxxx':87 'cve202612345':862 'cveid':1161,1169,1189 'data':131,290,421,516,544,545,678,895,1418 'date':1040,1045,1056,1074,1098,1110,1221,1347,1373,1379 'day':55,843,879,945,979,1001,1523 'dd':950,956 'decod':276 'deeper':1089 'default':754,829,840 'depth':1568 'descript':972,1081 'detail':1405 'digest':273 'disclosur':1220 'discuss':11,23,50,85,922,962,1065,1091,1224,1264,1368,1503,1524,1530,1550,1583 'dos':1420 'dynam':281 'e.g':156 'earli':66,1265 'earliest':1375 'either':475 'emerg':63 'en':958 'encod':313,538 'end':1044 'enddat':951,1174 'endpoint':309 'engag':1239 'ensur':132 'env':182 'environ':206,749 'error':188,766 'etc':985,1421 'event':1381 'evolv':1225 'exampl':1487 'exchang':368,463,488,787 'exist':372 'expert':1437 'exploit':59,873,1229,1243,1276,1322,1332,1365,1422,1479,1594 'export':757,1134 'extract':484,511,810,1314 'f':381,398,502,505,586,1027,1117,1123,1129 'fail':788 'feb':1382,1391,1398 'fetch':130,920 'field':935,968,989,1049,1078,1102,1178,1194 'find':21,84,959,1063,1510,1540,1578 'first':645,1216,1371,1386 'fit':204 'fix':1328 'flow':776 'follow':137,1082,1293,1433 'followerscount':973 'formal':74,1555 'free':687,1599 'general':820 'generat':240,252,1341 'getredditpostsbykeyword':987 'gettwitterpostsbykeyword':933 'gettwitterusersbykeyword':966 'github':1608 'go':680 'grant':301,518 'h':847 'hack':891 'handl':641 'hasaccesskey':223,610 'hashlib':258 'hashlib.sha256':271 'header':314,546,585 'high':1238,1292,1360,1440 'hour':72,1508,1561 'http':637 'http-stream':636 'id':332,336,388,392,530,533,813,936,969,990,1022,1029,1050,1103,1179,1195 'identifi':1214 'immedi':1277,1471 'impact':1416 'import':174,256,491,717,731,1017,1150 'impress':1061 'impressioncount':942 'independ':1309 'indic':1237,1335 'inform':1312,1590 'initi':1226 'instal':712,728 'instruct':804 'intel':36 'intellig':14,31,68,122,1207,1344 'investig':1482 'ioc':1334,1486,1597 'json':261,492,628 'json.dump':382 'json.dumps':291 'json.load':504 'json.loads':321,552 'key':181,673,695,707,722,741,760,762,781,1311,1430 'keyword':1071 'known':908,1300 'languag':957 'last':841,1506 'latest':1533 'leak':893,896,1419 'like':1057,1257 'likecount':940,1183 'link':425 'll':434 'log':1484 'log4shell':1502 'low':1259,1268,1362 'malwar':917 'mcp':149,209,352,614,769,924,1545 'mcp.xpoz.ai':234,288,356,361,542,583,633 'mcp.xpoz.ai/'',':355 'mcp.xpoz.ai/mcp':233,632 'mcp.xpoz.ai/mcp'',':582 'mcp.xpoz.ai/oauth/authorize?''':360 'mcp.xpoz.ai/oauth/register'',':287 'mcp.xpoz.ai/oauth/token'',':541 'mcporter':211,215,219,229,561,570,578,605,624 'mcpserver':629 'media':29,103,120,420,677,1517 'medium':1361,1610 'mention':33,52,1218,1270,1377,1388 'method':311,342 'mm':949,955 'monitor':4,26,42,101,827,886,1476,1499 'multipl':1308 'name':293,815,971,1080 'need':197,413,651,669,691,1279 'neither':194 'never':567 'new':737,1156 'nich':1297 'none':312 'notabl':1444 'note':1548 'npm':727 'num':1112 'numcom':996,1199 'oauth':237,242,503,526,531,536,642,775 'often':69,1553 'ok':373 'open':376,423,498 'openclaw':212 'operationid':1008 'order':141 'os':263,496 'os.makedirs':369 'os.path.expanduser':370,377,499,595 'os.remove':594 'osint':3,27,40,107,1509,1618 'output':575 'overview':41 'param':326,363 'pars':807 'past':438,693 'patch':1230,1256,1326,1370,1402,1426 'patch/mitigate':1472 'path':202,207,612,659 'pentest':1289 'period':839,1346 'pip':711 'platform':6,828 'pleas':422,679 'poc':1228,1247,1324,1366,1423 'poll':1004 'post':1035,1037,1093,1095,1121,1127,1212,1298,1352,1355,1397,1434,1445,1457 'potenti':1219 'preced':1554 'print':399,568,597,1116,1122,1128 'problem':767 'proceed':457 'progress':1251 'prompt':658,1488 'provid':65,472,1566,1570 'public':1217,1387,1557 'publish':1325 'python':171,255,490,662,709,714,1012,1014 'queri':853,934,967,988,1026,1038,1072,1096 'quot':1447 'r/cybersecurity':983,1465,1565 'r/hacking':984 'r/netsec':982,1394,1460,1563 'rang':1348 'ransomwar':900,1534 'rapid':1240 'raw':477 'rce':875,1417 're':772,793 're-author':792 're-run':771 'read':178,325,555 'readi':225 'recommend':1468 'reconstruct':1209 'reddit':45,126,831,981,1088,1092,1124,1141,1353,1393,1539,1562 'reddit_posts.export':1143 'reddit_posts.pagination.total':1125 'redditpost':1186 'redirect':296,344,393,524,527 'referenc':1306 'reg':284,319,323,333,389 'registr':283 'relat':49 'relev':1084 'relevanttweetscount':974,1573 'relevanttweetslikessum':975 'remote/local':1319,1413 'remov':572 'repli':451,515,704 'report':58,115,1227,1333,1342,1480,1512 'req':285,324,539,554 'request':809 'requir':1321,1415 'research':108,834,927,961,1032,1064,1067,1130,1245,1284,1385,1432,1450,1542 'researchers.pagination.total':1131 'resourc':354 'resp':320,334,390,551,557 'respond':460,1254 'respons':305,328 'results/month':1602 'return':609 'retweet':1059 'retweetcount':941,1184 'row':1120,1126,1132 'rstrip':274 'run':773 's256':343 'save':364 'say':98,1494 'scope':351,822 'score':995,1111,1198 'sdk':169,661,778,1013,1148 'search':1576 'secret':257 'secrets.token':265,278 'secur':2,8,24,39,48,96,833,921,926,960,1031,1244,1283,1288,1296,1301,1343,1436,1449,1492,1541,1549,1617 'security-osint':1,1616 'security-rel':47 'see':435 'seen':1372 'send':245,404 'sensit':1589 'server':1546 'set':747 'setup':127 'sever':1231,1269,1358 'share':61,1246,1338 'sign':427 'signal':1235,1236 'singl':798 'single-us':797 'skill':295,1613 'skill-security-osint' 'skip':161,189 'social':5,28,102,119,419,676,1234,1376,1407,1516 'softwar':105,814,865,867,1410 'software/versions':1316 'solut':768 'sort':1210 'sourc':1280,1310,1349,1380,1408,1607 'source-xpozpublic' 'specif':823,856 'speed':1571 'spread':1241 'stage':1266 'start':1039,1073,1097 'startdat':943,977,999,1170,1190 'state':277,349,350,365,385,386 'status':1327,1363 'step':163,191,250,402,444,461,601,801,803,805,918,1203,1339 'step-by-step':800 'stream':638 'subprocess':495 'subprocess.run':569,577 'subreddit':997,1114,1200,1454,1456 'succeed':186 'success':600 'summari':1357 'talk':1543 'target':811,852,1345 'technic':1090,1262,1395,1404,1567 'technical-on':1261 'tell':410 'text':937,992,1051,1105,1180,1197 'thread':1459 'threat':9,25,35,64,110,121,817,850,902,905,1206,1356,1585 'tier':1600 'time':838 'timelin':1208,1378 'titl':991,1104,1196,1462,1467 'today':952 'token':308,367,468,556,559,564,565,589,786 'tool':150,155,353,646 'top':1458 'topic':821,964 'topic-agent-skills' 'topic-ai-agents' 'topic-claude-code' 'topic-claude-code-skills' 'topic-claude-skills' 'topic-codex-cli' 'topic-mcp' 'topic-reddit-api' 'topic-skill-md' 'topic-skillsmp' 'topic-social-intelligence' 'topic-social-media' 'track':904,1222,1529 'transport':635 'tri':151,170 'true':224,374,576,591,611 'tweet':1085 'twitt':38 'twitter':92,124,830,925,1030,1034,1118,1137,1350,1384,1400,1500,1537,1552,1569 'twitter/x':43 'twitter_posts.export':1139 'twitter_posts.pagination.total':1119 'twitterpost':1166 'type':302,306,317,329,519,549 'typescript':664,725,730,1147,1149 'unauthor':770 'unnecessarili':1598 'uri':297,345,394,525,528 'url':243,254,359,401,406,430,481,631,998,1115 'urllib.parse':260,494 'urllib.parse.urlencode':327,517 'urllib.request':262,493 'urllib.request.request':286,540 'urllib.request.urlopen':322,553 'urlsaf':266,279 'use':15,17,78,752,799,844,1572 'user':82,249,409,449,471,510,513,622,649,667,702,724,743,764,790,1069,1133,1575 'usernam':970,1053,1079,1107,1451 'utm':1606,1609,1614 'var':183 'variabl':750 'vector':1318,1412 'vendor':1252,1401 'verifi':264,383,384,535,537,603,780,976,1087,1282 'verifier.encode':272 'version':1411,1428 'via':210,615,923,1011,1146 'voic':1431 'volum':1260 'vs':825 'vuln':871 'vulner':10,30,100,106,824,866,869,1390,1547 'w':379 'wait':446,699 'warn':67 'watch':1477 'weapon':1249 'week':1528 'wild':1274 'without':187,623 'work':160,195 'workaround':1329,1429 'www.xpoz.ai':299,347,396 'www.xpoz.ai/oauth/openclaw''':395 'www.xpoz.ai/oauth/openclaw'',':346 'www.xpoz.ai/oauth/openclaw''],':298 'x':1351,1354,1452,1453,1461,1463,1464,1466 'xpoz':16,133,154,173,179,232,417,573,581,598,630,671,713,716,758,1016 'xpoz.ai':683,784,1604,1605 'xpoz.ai/get-token':682 'xpoz.ai/settings](https://xpoz.ai/settings)':783 'xpoz.checkaccesskeystatus':221,607 'xpoz/xpoz':729,734,1153 'xpozclient':175,177,718,720,732,738,1018,1020,1151,1157 'xxxx':89 'xxxxx':90 'yyyi':948,954 'yyyy-mm-dd':947,953 'zero':54,878,1522 'zero-day':53,877,1521","prices":[{"id":"12c0d22a-b1e2-411d-b28e-ba9dd3ad80bc","listingId":"1c0286ec-8917-4881-927c-5180f7f97f38","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"XPOZpublic","category":"xpoz-agent-skills","install_from":"skills.sh"},"createdAt":"2026-04-23T13:04:17.606Z"}],"sources":[{"listingId":"1c0286ec-8917-4881-927c-5180f7f97f38","source":"github","sourceId":"XPOZpublic/xpoz-agent-skills/security-osint","sourceUrl":"https://github.com/XPOZpublic/xpoz-agent-skills/tree/main/skills/security-osint","isPrimary":false,"firstSeenAt":"2026-04-23T13:04:17.606Z","lastSeenAt":"2026-05-18T19:08:21.931Z"}],"details":{"listingId":"1c0286ec-8917-4881-927c-5180f7f97f38","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"XPOZpublic","slug":"security-osint","github":{"repo":"XPOZpublic/xpoz-agent-skills","stars":10,"topics":["agent-skills","ai-agents","claude-code","claude-code-skills","claude-skills","codex-cli","mcp","reddit-api","skill-md","skillsmp","social-intelligence","social-media","social-media-api","twitter-api"],"license":"mit","html_url":"https://github.com/XPOZpublic/xpoz-agent-skills","pushed_at":"2026-02-24T21:40:32Z","description":"Agent skills for social media intelligence, powered by Xpoz. Compatible with Claude Code, Codex CLI, and ChatGPT.","skill_md_sha":"7d7481658fbd3134802bf10179a38cc39d13cdac","skill_md_path":"skills/security-osint/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/XPOZpublic/xpoz-agent-skills/tree/main/skills/security-osint"},"layout":"multi","source":"github","category":"xpoz-agent-skills","frontmatter":{"name":"security-osint","description":"Monitor social platforms for security threats, vulnerability discussions, and breach intelligence using Xpoz. Use when asked to \"find CVE discussions\", \"security threat monitoring\", \"OSINT social media\", \"vulnerability intelligence\", \"breach mentions\", or \"threat intel from Twitter/Reddit\"."},"skills_sh_url":"https://skills.sh/XPOZpublic/xpoz-agent-skills/security-osint"},"updatedAt":"2026-05-18T19:08:21.931Z"}}