The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external content from Instagram (profiles, captions, bios) via the Crawlora API. This creates a surface for indirect prompt injection where malicious instructions could be embedded in public social media text.
Ingestion points: Data retrieved from api.crawlora.net through the scripts/crawlora.sh helper script.
Boundary markers: The skill is designed to return normalized JSON, and the documentation recommends using jq for parsing, which helps maintain data boundaries.
Capability inventory: The skill utilizes curl for network requests. It does not possess file-writing, privilege escalation, or arbitrary code execution capabilities.
Sanitization: The scripts/crawlora.sh script implements robust security measures, including a strict regex-based allow-list for API paths and the use of curl --data-urlencode to ensure query parameters are safely handled.

instagram-research