Find the people who want to buy right now. This skill scans the four platforms for fresh buying-intent posts (people asking for what a product does, or frustrated with the alternatives), qualifies the real asks, and delivers a prioritized report of where to comment and who to reach while the intent is still live. It finds and reports; humans do all engagement. The skill never posts, comments, DMs, or contacts anyone.
\nActivate when the user asks:
\nBefore fetching data, ensure Xpoz access is configured. Follow these checks in order.
\nIf you have MCP tools, try calling any Xpoz tool (e.g., checkAccessKeyStatus). If it works → skip to Step 1.
If you have the SDK, try:
\nfrom xpoz import XpozClient\nclient = XpozClient() # reads XPOZ_API_KEY env var\nIf this succeeds without error → skip to Step 1.
\nIf neither works, you need to authenticate. Get a free access key (below).
\nReal analyses need a real key: get a free access key (free tier, up to 75K results, no credit card). SDK and CLI users set it as XPOZ_API_KEY; MCP connections sign in with the same account via OAuth on first tool call (paths below).
If mcporter is available:
mcporter call xpoz.checkAccessKeyStatus\nIf hasAccessKey: true → ready. If not:
mcporter config add xpoz https://mcp.xpoz.ai/mcp --auth oauth\nThen authenticate — generate the OAuth URL and send it to the user:
\nStep 1: Generate authorization URL
\nimport secrets, hashlib, base64, urllib.parse, json, urllib.request, os\n\nverifier = secrets.token_urlsafe(64)\nchallenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b'=').decode()\nstate = secrets.token_urlsafe(32)\n\n# Dynamic client registration\nreg_req = urllib.request.Request(\n 'https://mcp.xpoz.ai/oauth/register',\n data=json.dumps({\n 'client_name': 'Agent Skills',\n 'redirect_uris': ['https://www.xpoz.ai/oauth/openclaw'],\n 'grant_types': ['authorization_code'],\n 'response_types': ['code'],\n 'token_endpoint_auth_method': 'none',\n }).encode(),\n headers={'Content-Type': 'application/json'},\n)\nreg_resp = json.loads(urllib.request.urlopen(reg_req).read())\n\nparams = urllib.parse.urlencode({\n 'response_type': 'code',\n 'client_id': reg_resp['client_id'],\n 'code_challenge': challenge,\n 'code_challenge_method': 'S256',\n 'redirect_uri': 'https://www.xpoz.ai/oauth/openclaw',\n 'state': state,\n 'scope': 'mcp:tools',\n 'resource': 'https://mcp.xpoz.ai/',\n})\n\nauth_url = 'https://mcp.xpoz.ai/oauth/authorize?' + params\n\n# Save state for token exchange\nos.makedirs(os.path.expanduser('~/.cache/xpoz-oauth'), exist_ok=True)\nwith open(os.path.expanduser('~/.cache/xpoz-oauth/state.json'), 'w') as f:\n json.dump({'verifier': verifier, 'state': state, 'client_id': reg_resp['client_id'],\n 'redirect_uri': 'https://www.xpoz.ai/oauth/openclaw'}, f)\n\nprint(auth_url)\nStep 2: Send the URL to the user
\nTell them:
\n\n\n\"I need to connect to Xpoz for social media data. Please open this link and sign in:
\n[auth_url]
\nAfter authorizing, you'll see a code. Paste it back to me here.\"
\n
Step 3: WAIT for the user to reply with the code. Do not proceed until they respond.
\nStep 4: Exchange the code for a token
\nOnce the user provides the code (either a raw code or a URL containing ?code=...), extract the code and exchange it:
import json, urllib.request, urllib.parse, subprocess, os\n\nwith open(os.path.expanduser('~/.cache/xpoz-oauth/state.json')) as f:\n oauth = json.load(f)\n\ncode = \"THE_CODE_FROM_USER\" # Extract from user's reply\n\ndata = urllib.parse.urlencode({\n 'grant_type': 'authorization_code',\n 'code': code,\n 'redirect_uri': oauth['redirect_uri'],\n 'client_id': oauth['client_id'],\n 'code_verifier': oauth['verifier'],\n}).encode()\n\nreq = urllib.request.Request(\n 'https://mcp.xpoz.ai/oauth/token',\n data=data,\n headers={'Content-Type': 'application/x-www-form-urlencoded'},\n)\nresp = json.loads(urllib.request.urlopen(req).read())\ntoken = resp['access_token']\n\n# Configure mcporter with the token (token is never printed)\nsubprocess.run(['mcporter', 'config', 'remove', 'xpoz'], capture_output=True)\nsubprocess.run(['mcporter', 'config', 'add', 'xpoz', 'https://mcp.xpoz.ai/mcp',\n '--header', f'Authorization=Bearer {token}'], check=True)\n\n# Clean up\nos.remove(os.path.expanduser('~/.cache/xpoz-oauth/state.json'))\nprint(\"Xpoz configured successfully\")\nStep 5: Verify with mcporter call xpoz.checkAccessKeyStatus → should return hasAccessKey: true.
For Claude Code users without mcporter:
\nclaude mcp add --transport http xpoz https://mcp.xpoz.ai/mcp\nClaude Code handles OAuth automatically on first tool call — the user just needs to authorize in their browser when prompted.
\nAsk the user:
\n\n\n\"I need a Xpoz API key to access social media data. Please go to https://xpoz.ai/get-token (it's free, no credit card needed) and paste the key back to me.\"
\n
WAIT for the user to reply with the key. Then:
\nPython:
\npip install xpoz\nfrom xpoz import XpozClient\nclient = XpozClient(\"THE_KEY_FROM_USER\")\nTypeScript:
\nnpm install @xpoz/xpoz\nimport { XpozClient } from \"@xpoz/xpoz\";\nconst client = new XpozClient({ apiKey: \"THE_KEY_FROM_USER\" });\nawait client.connect();\nOr set the environment variable and use the default constructor:
\nexport XPOZ_API_KEY=THE_KEY_FROM_USER\n| Problem | \nSolution | \n
|---|---|
| MCP: \"Unauthorized\" | \nRe-run the OAuth flow above | \n
SDK: AuthenticationError | \nVerify key at xpoz.ai/settings | \n
| Token exchange fails | \nAsk user to re-authorize — codes are single-use | \n
Extract, asking the user for whatever is missing:
\nThree search motions, all run every scan:
\nBuild OR-joined query strings per bucket, e.g. \"looking for a social listening tool\" OR \"brand monitoring recommendations\" OR \"how do you track mentions\". Three practical constraints:
When working under a call budget, spend it in this order: Reddit asking bucket, Reddit competitor bucket, Twitter/X competitor bucket, Twitter/X asking bucket, Reddit comments, then Instagram and TikTok; the first three carry most of the signal. The own-brand motion needs no call of its own under budget: fold its anchored phrases into the competitor buckets' queries.
\nOne more query rule: a brand name that doubles as a common English word (\"plausible\", \"fathom\", \"mention\") must be anchored; a category word makes the cleanest anchor (\"plausible analytics\"), a rival pairing second (\"plausible vs umami\", which still leaks occasionally). Unanchored, the bucket drowns in false positives.
\nRun each query bucket per platform:
\nCall getRedditPostsByKeywords:\n query: \"<bucket query>\"\n fields: [\"id\", \"title\", \"authorUsername\", \"subredditName\", \"score\", \"commentsCount\", \"createdAtDate\", \"permalink\"]\n limit: 15\n startDate: \"<window start, YYYY-MM-DD>\"\n endDate: \"<today, YYYY-MM-DD>\"\n userPrompt: \"<the user's original request, for relevance tuning>\"\nMechanics that matter:
\nresponseType: \"paging\" or \"csv\" return an operationId, and only those need polling via checkOperationStatus (every ~5 seconds until finished). For a scan, fast mode with a limit of 10-15 is right; without limit you get up to 300 rows.getRedditPostWithCommentsById; selftexts can be huge and one blog-length post can dwarf the rest of the response.startDate/endDate deliberately, since freshness is the product. Verify dates client-side; an occasional result lands just outside the requested window. Verify quoted phrases client-side too: the relevance layer occasionally returns results containing none of them, which matters most for common-word brand queries.Repeat for Twitter/X:
\nCall getTwitterPostsByKeywords:\n query: \"<bucket query>\"\n fields: [\"id\", \"text\", \"authorUsername\", \"createdAtDate\", \"likeCount\", \"replyCount\", \"conversationId\", \"replyToTweetId\"]\n filterOutRetweets: true\n limit: 15\n startDate: \"<window start>\"\n endDate: \"<today>\"\n userPrompt: \"<the user's original request, for relevance tuning>\"\nThe conversationId field is what makes Step 4's reply-chasing possible (replyToTweetId is often null even on real replies); without it a reply cannot be traced to its thread. Budget permitting, repeat with getInstagramPostsByKeywords and getTiktokPostsByKeywords. Reddit comments often hold the asks that posts don't; add:
Call getRedditCommentsByKeywords:\n query: \"<asking-bucket query>\"\n fields: [\"id\", \"body\", \"authorUsername\", \"score\", \"createdAtDate\", \"parentPostId\"]\n limit: 15\n startDate: \"<window start>\"\n endDate: \"<today>\"\nSparse results on a narrow fresh window are a coverage signal, not a demand verdict: comment search runs against the database only and can legitimately return nothing for the last 7 days, and even post search can come back thin. Before concluding \"no demand,\" widen the window or rephrase; before concluding \"demand,\" read what actually came back. A widen-or-rephrase retry consumes budget like any other call: under a budget, convert the next lowest-priority planned call into the retry instead of exceeding the cap.
\nfrom xpoz import XpozClient\n\nclient = XpozClient()\n\nreddit = client.reddit.search_posts(\n '\"looking for a social listening tool\" OR \"brand monitoring recommendations\"',\n start_date=\"2026-08-19\",\n end_date=\"2026-08-26\",\n fields=[\"id\", \"title\", \"text\", \"author_username\", \"subreddit\", \"score\", \"num_comments\", \"created_at_date\", \"url\"],\n)\n\ntwitter = client.twitter.search_posts(\n '\"[competitor] alternative\" OR \"[competitor] pricing\"',\n start_date=\"2026-08-19\",\n end_date=\"2026-08-26\",\n fields=[\"id\", \"text\", \"author_username\", \"created_at_date\", \"like_count\", \"reply_count\"],\n)\n\nclient.close()\nDifferent platforms yield different lead shapes; classify every candidate as one of:
\nOne more shape worth naming: existing-user distress, a current user of the product publicly churning or struggling. That is a retention save, not buying intent: report it separately with a support-shaped angle (concrete help, no pitch), never inflate it into a P1.
\nChase replies up to their thread. Some of the best hits are replies or comments whose parent thread is the real lead. Resolve them before classifying: on Reddit, getRedditPostWithCommentsById on the comment's parentPostId; on X, getTwitterPostsByIds on the conversationId fetches the root post (for the surrounding replies, getTwitterPostComments on that root). Report the thread, not the reply.
Qualify first. The ask is the qualifier: intent, not venting, and the author should plausibly own the buying decision. Hard disqualifiers, never reported: vendors selling a competing solution, keyword hits in unrelated contexts, obvious spam or engagement bait.
\nPrioritize by judgment, not arithmetic, weighing four things, and say in one line why each lead landed where it did:
\ncreatedAtDate means unknown freshness: rank below any dated fresh item and say so in the lead.Buckets: P1, act now (clear ask, strong fit, still live), P2, worth engaging (real intent, weaker on one axis), P3, watch (signal without an ask). Everything else drops.
\n## Lead Scan: [PRODUCT]\n**Window:** [dates] | **Platforms:** [list] | **Candidates reviewed:** [n]\n\n### This Week's Picks\n[3-5 leads sized to what a human can actually act on today, one line each with link]\n\n### P1: Act Now\n[Write \"None this week\" when nothing earns it; an honest empty bucket beats a padded one.]\n#### [Platform] | [thread/post title or author] | [link]\n- **The ask:** \"[quote]\"\n- **Why it qualifies:** [intent + fit + freshness in one line]\n- **Suggested angle:** [what a useful reply covers; never a full draft]\n\n### P2: Worth Engaging\n[Same shape, shorter]\n\n### Named Prospects\n[Individual users from the likely-converter shape: handle, platform, the signal quoted, suggested approach. Omit the section if none qualified.]\n\n### P3: Watch\n[One line each: the signal and what change would promote it]\n\n### Demand Signals\n[Patterns that repeated across candidates: recurring pains, phrasings, competitor complaints. Content and product fuel.]\n\n### Search Notes\n[Which queries produced, which came up dry, phrasings discovered along the way worth adding next scan]\n