instagram-research
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Instagram content, creating a surface for potential indirect prompt injection attacks.\n
- Ingestion points: Public comments and post data are ingested via the
instagram-commentsandinstagram-postsroutes as specified inreferences/audience-voice.mdandreferences/shared-contract.md.\n - Boundary markers: The instructions in
SKILL.mdandreferences/shared-contract.mdprovide guidance on routing and evidence labeling but do not include explicit delimiters or warnings to the agent to ignore instructions embedded within the scraped comment text.\n - Capability inventory: The skill utilizes the
postplusCLI to execute commands and write output to the filesystem (SKILL.md), and performs network-based search and enrichment (references/creator-discovery.md).\n - Sanitization: The provided instructions do not mention any automated sanitization, filtering, or escaping of the comment content before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill executes shell-based commands using the
postplustool to interact with the Instagram research API.\n - Evidence:
SKILL.mdcontains instructions for the agent to runpostplus research run <route>with various semantic flags based on user input. While this is the intended workflow for the vendor 'postplusai', it represents the primary execution surface for the skill.
Audit Metadata