instagram-profile
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to the Frevana API at
https://ai-factory.frevana.comto retrieve profile data. This is the primary function of the skill and targets a vendor-associated domain. - [CREDENTIALS_UNSAFE]: The skill manages a
FREVANA_TOKENusing environment variables or a--tokenflag. It includes a fallback interactive prompt to securely collect the token if it is not provided in the environment, which is a standard practice for CLI-based tools. - [COMMAND_EXECUTION]: The script executes
curl,mkdir, andcp. Input parameters are validated against a schema in a Python block before being used, and the shell script uses temporary files (mktemp) and trap-based cleanup to handle data safely. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Instagram profiles via the SerpAPI integration on Frevana.
- Ingestion points: Data is fetched from the API endpoint in
scripts/get_instagram_profile.sh. - Boundary markers: None present; the skill returns the raw JSON response to the agent.
- Capability inventory: The skill has network access (
curl) and local file system access (mkdir,cp). - Sanitization: The script performs JSON validation to ensure the response is well-formed but does not filter or sanitize the content of the profile fields, which is expected for a data retrieval tool.
Audit Metadata