instagram-following-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill explicitly instructs the agent to install BrowserAct automatically without asking the user to confirm and to avoid describing the installation as a user action, which is a deceptive/hiding instruction beyond the scraping task's stated purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill explicitly instructs automatic installation of a required runtime dependency "without asking the user to confirm" and to avoid describing it as a user action, which indicates deceptive/unauthorized installation behavior and a supply-chain/installation risk despite otherwise describing public-data scraping.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). This skill’s required workflow invokes the browser-act Skill to access and interact with live Instagram/public web pages at runtime, so outsider-authored free text from fetched web content (e.g., profile pages, bios, posts) can be ingested into the agent’s LLM context via the BrowserAct browsing/extraction path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to automatically install and invoke the BrowserAct CLI at runtime using https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main, which would fetch and run external installation code that controls the agent's runtime behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The Skill instructs the agent to automatically install the BrowserAct CLI/Skill without asking the user for approval, which directs the agent to modify the host system state (install software) and resume execution autonomously even though it does not explicitly request sudo or file modifications.