The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx --yes apify-cli@latest to run the Apify Command Line Interface. This is a standard and recommended practice for interacting with the Apify platform to ensure the latest version is used.
[COMMAND_EXECUTION]: The skill uses curl to make authenticated POST and GET requests to Apify's REST API (api.apify.com). It also executes local shell commands to check for the presence of authentication files and environment variables.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill implements best practices for secret management. It explicitly instructs against asking the user for their API token and instead uses the Apify CLI's browser-based login flow, which stores the token in the operating system's secure keyring. This prevents credentials from appearing in the agent's conversation logs or shell history.
[INDIRECT_PROMPT_INJECTION]: As a scraper, the skill ingests untrusted data from Instagram (captions, comments, bio text). While this represents a theoretical attack surface for indirect prompt injection, it is the primary purpose of the skill, and the skill does not grant excessive privileges that would make this surface highly exploitable.

instagram-scraper