instagram-profile

SUSPICIOUS: The skill's purpose and capabilities mostly align, but it routes Instagram/SerpApi access through Frevana instead of official APIs and allows the API base URL to be overridden, which weakens data-flow integrity and could redirect the bearer token to an arbitrary host. No malicious payloads or installer abuse are shown, so this looks more like a third-party gateway trust risk than confirmed malware.