instagram-lead-scraper
Warn
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/instagram-lead-scraper.jsdisables global TLS certificate verification by settingprocess.env.NODE_TLS_REJECT_UNAUTHORIZED = '0', which is a dangerous security practice that bypasses standard connection security. - [DATA_EXFILTRATION]: Certificate validation is explicitly disabled for the PostgreSQL database connection in
scripts/instagram-lead-scraper.jsusing therejectUnauthorized: falseconfiguration. This exposes sensitive database credentials and lead data to Man-in-the-Middle (MitM) attacks. - [DATA_EXFILTRATION]: (Indirect Prompt Injection Surface)
- Ingestion points: Untrusted lead data is ingested from Instagram profiles via the Apify actor in
scripts/instagram-lead-scraper.js. - Boundary markers: The script does not use any boundary markers or instructions to treat the incoming data as untrusted content.
- Capability inventory: The script performs database writes (
INSERT) and file system reads (accessing.env) inscripts/instagram-lead-scraper.js. - Sanitization: While parameterized SQL queries are used to prevent SQL injection, there is no sanitization of the content of the scraped profile data itself.
Audit Metadata