scraping-instagram-posts-by-hashtag
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides a
customMapFunctioninput parameter that accepts a JavaScript function as a string. This string is executed at runtime to transform scraped data, which represents a dynamic code execution vector.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from Instagram, including post captions and author metadata. This data could potentially contain malicious instructions intended to influence the agent's behavior. - Ingestion points: Instagram hashtag search results including captions and user information fetched via the Apify API.
- Boundary markers: No explicit delimiters or instructions to ignore instructions within the data are present in the skill configuration.
- Capability inventory: The skill uses
curlandnodefor execution and includes functionality to write output to the local file system (CSV/JSON). - Sanitization: No sanitization of the external content is performed before it is presented to the agent.
- [COMMAND_EXECUTION]: The workflow involves shell commands (
node,curl) to run local scripts and interact with the Apify REST API. These commands process user-supplied parameters and environment variables likeAPIFY_TOKEN. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
api.apify.com, which is a well-known service for data processing and automation.
Audit Metadata