instagram-scraper

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill’s runtime reads results from Apify’s apify/instagram-scraper actor via curl POST to https://api.apify.com/v2/acts/apify~instagram-scraper/run-sync-get-dataset-items... (and potentially fetched dataset items from runs), where the ingested free text is outsider-authored Instagram content only insofar as the caller supplies directUrls/search to target it.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime calls to Apify's APIs (e.g., https://api.apify.com/v2/acts/apify~instagram-scraper/run-sync-get-dataset-items?timeout=120) which trigger execution of the remote Apify actor (remote code) and are required for the skill to work.