instagram-profile-meta

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path uses eval "$(python scripts/get-profile-meta.py '{username}')" which performs a fetch to Instagram’s public web endpoint (https://www.instagram.com/api/v1/users/web_profile_info/?username=...) and ingests the returned JSON fields (e.g., biography) into the agent context, which is outsider-authored free text from a public web source.