The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/config.py contains a hardcoded IMGUR_CLIENT_ID ("546c25a59c58ad7"). While used for anonymous uploads, hardcoding API identifiers is a sub-optimal security practice.
[DATA_EXFILTRATION]: The skill automatically uploads local media files to Imgur (api.imgur.com) to generate the public URLs required by the Instagram Graph API. This behavior, implemented in scripts/api_client.py and used in scripts/publish.py, results in user content being hosted on a third-party service without explicit per-action user confirmation of the external storage provider.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain malicious instructions.
Ingestion points: Fetches comments (scripts/comments.py), direct messages (scripts/messages.py), and hashtag search results (scripts/hashtags.py) directly from the Instagram API into the agent's context.
Boundary markers: The skill does not implement clear delimiters or instructions to ignore embedded commands within the fetched social media content.
Capability inventory: The skill possesses high-impact capabilities including publishing content (scripts/publish.py), sending messages (scripts/messages.py), and deleting comments (scripts/comments.py).
Sanitization: No evidence of sanitization or filtering of fetched content before it is processed by the AI agent.

instagram