scraping-instagram-location-posts
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill accepts a
customMapFunctioninput parameter, which is a string containing a JavaScript function. This code is passed to the Apify platform to be executed during the data transformation phase of the scraping process, allowing for remote execution of user-supplied logic. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from Instagram posts, including captions and author handles, which are returned to the agent context.
- Ingestion points: External data is fetched from Instagram via the Apify API (
api.apify.com) inSKILL.md. - Boundary markers: The instructions do not define clear delimiters or "ignore instructions" wrappers for the retrieved post content.
- Capability inventory: The skill uses local command execution (
node scripts/run_actor.js) and network operations viacurl. - Sanitization: No sanitization or escaping of the Instagram captions or metadata is specified before interpolation into the output format.
- [EXTERNAL_DOWNLOADS]: The skill fetches data and triggers automation through the Apify REST API (
api.apify.com). This is a well-known service and the primary infrastructure for the skill's stated purpose. - [COMMAND_EXECUTION]: The skill instructs the agent to execute a local script (
node scripts/run_actor.js) to interact with the Apify API and handle results. It also providescurlcommands for manual fallbacks.
Audit Metadata