instagram-scraper
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of 'apify-client' for Python and Node.js. These are well-known official libraries used to interact with the Apify automation platform.
- [COMMAND_EXECUTION]: The documentation provides shell command examples using 'curl' to interact with Apify's REST API and 'jq' to process JSON responses. These are standard methods for API integration and polling.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from Instagram (posts, comments, profile descriptions), which constitutes untrusted external content.
- Ingestion points: Data enters the environment from Apify API endpoints, such as 'api.apify.com/v2/actor-runs/'.
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between its instructions and the data fetched from Instagram.
- Capability inventory: The skill performs network operations via 'curl' and uses the 'apify-client' library to communicate with external servers.
- Sanitization: The provided integration examples do not include explicit logic for sanitizing or escaping the scraped content before it is processed by the agent.
Audit Metadata