finding-hospitality-brands-on-instagram
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Instagram profiles and posts, such as bios and engagement rates, which are untrusted sources. Ingestion points: Instagram profiles, hashtags, and location data specified in startUrls. Boundary markers: The skill does not define specific delimiters to isolate external content from instructions. Capability inventory: The skill uses local scripts (run_actor.js) and curl for data processing. Sanitization: No text sanitization or filtering is documented for the ingested bio or post content.- [DYNAMIC_EXECUTION]: The customMapFunction input parameter facilitates the execution of JavaScript code on the remote Apify platform for data transformation.- [COMMAND_EXECUTION]: The documentation provides command-line examples for running a local Node.js script and using curl to trigger API runs.- [EXTERNAL_DOWNLOADS]: The skill communicates with api.apify.com to execute scraping tasks, which is a well-known and reputable service provider.
Audit Metadata