instagram-profile

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill connects to the Frevana API at https://ai-factory.frevana.com to retrieve profile data. This is the primary function of the skill and targets a vendor-associated domain.
  • [CREDENTIALS_UNSAFE]: The skill manages a FREVANA_TOKEN using environment variables or a --token flag. It includes a fallback interactive prompt to securely collect the token if it is not provided in the environment, which is a standard practice for CLI-based tools.
  • [COMMAND_EXECUTION]: The script executes curl, mkdir, and cp. Input parameters are validated against a schema in a Python block before being used, and the shell script uses temporary files (mktemp) and trap-based cleanup to handle data safely.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Instagram profiles via the SerpAPI integration on Frevana.
  • Ingestion points: Data is fetched from the API endpoint in scripts/get_instagram_profile.sh.
  • Boundary markers: None present; the skill returns the raw JSON response to the agent.
  • Capability inventory: The skill has network access (curl) and local file system access (mkdir, cp).
  • Sanitization: The script performs JSON validation to ensure the response is well-formed but does not filter or sanitize the content of the profile fields, which is expected for a data retrieval tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 03:39 PM
Security Audit — agent-trust-hub — instagram-profile