instagram-video-downloader
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the vendor's API endpoint at
https://redfox.hk/story/api/parseWork/videoDownload/instagramto retrieve video metadata and download links. This is the primary intended function of the skill. - [COMMAND_EXECUTION]: The skill is designed to be executed via a Python script (
scripts/downloader.py) which processes user-provided Instagram URLs. The script uses standard libraries and validates input before making API calls. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it retrieves and displays the description of Instagram posts. An attacker could place malicious instructions in a post's caption that would then be processed by the agent.
- Ingestion points:
scripts/downloader.pyretrieves thedescfield from the API response and prints it to the console. - Boundary markers: No explicit delimiters are used when displaying retrieved content.
- Capability inventory: The script performs network requests and maintains a configuration file in the user's home directory (
~/.qoder/apis/redfox.json). - Sanitization: No sanitization or filtering is applied to the retrieved post descriptions.
Audit Metadata