instagram-scraper-api
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external social media profiles which may contain malicious instructions.
- Ingestion points: The agent receives raw JSON data from Instagram via api.scavio.dev, specifically fields containing captions, user bios, and comment threads.
- Boundary markers: The skill instructions do not provide explicit delimiters or "ignore previous instructions" warnings to the agent regarding the content retrieved from the API.
- Capability inventory: While the skill permits network operations to the Scavio API, it does not demonstrate capabilities for file system modification, local command execution, or persistence.
- Sanitization: There is no evidence of sanitization or filtering of the ingested social media content before it is provided to the agent.
Audit Metadata