threads-user-posts
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
scripts/extract-posts.pyandscripts/scroll-load-more.py) to generate JavaScript code dynamically. This code is then evaluated in the browser context to perform data extraction and page scrolling. While the scripts are local, this pattern of generating and evaluating code represents a dynamic execution surface.\n- [EXTERNAL_DOWNLOADS]: The skill navigates to and interacts with threads.com to retrieve user profile data and post history. This is the primary function of the skill and involves communication with a well-known service.\n- [PROMPT_INJECTION]: The skill extracts text content (captions) from Threads posts, which are controlled by external users. This creates a surface for indirect prompt injection where an attacker could place instructions in a post to influence the agent's subsequent actions.\n - Ingestion points: Text content from Threads posts is extracted via
scripts/extract-posts.pyfrom the mediaData object found in the profile's SSR HTML.\n - Boundary markers: The instructions do not define clear delimiters or markers to separate scraped content from agent instructions, nor do they advise the agent to ignore embedded commands.\n
- Capability inventory: The skill uses
browser-actfor navigation, network monitoring, and JavaScript evaluation, alongside shell execution for running Python scripts.\n - Sanitization: There is no evidence of sanitization, filtering, or validation of the extracted post text to prevent the processing of embedded instructions.
Audit Metadata