instagram-profile
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The get_instagram_profile.sh script executes curl for API communication and python3 for data processing and validation tasks.- [DATA_EXFILTRATION]: The skill transmits the FREVANA_TOKEN to the ai-factory.frevana.com domain for authentication. While this is the intended use of the API, it involves sending sensitive credentials to an external service.- [DYNAMIC_EXECUTION]: The bash script employs embedded Python code, executed via stdin, to handle argument parsing and JSON structure validation at runtime.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a third-party API and passes it to the agent, creating a potential path for indirect instructions.
- Ingestion points: Instagram profile data is fetched from the Frevana API in scripts/get_instagram_profile.sh.
- Boundary markers: There are no explicit markers or instructions provided to the agent to delineate and ignore instructions within the retrieved data.
- Capability inventory: The skill allows writing API responses to arbitrary file paths via the --output argument and performs network requests.
- Sanitization: The script verifies the JSON format of the response but does not sanitize the actual content before it is displayed to the user or saved to disk.
Audit Metadata