ig-audience-insights
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill integrates with Apify to fetch Instagram data. It instructs users to obtain an API token from the official console.apify.com domain, which is a well-known service for web scraping and data extraction. This is a standard integration for the skill's stated purpose.
- [CREDENTIALS_UNSAFE]: The skill mentions using an
APIFY_TOKENfor authentication. It follows safe practices by instructing the user to set this as an environment variable or provide it through proper integration channels rather than hardcoding any secrets. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Instagram (captions, bios, post content) via the Apify client. While this presents a theoretical attack surface, the skill's logic is focused on statistical analysis (ranking by engagement, extracting patterns) rather than executing instructions found within that data. No high-privilege capabilities or dangerous subprocess calls are present in the provided instructions.
- [COMMAND_EXECUTION]: The skill uses a library-based approach (
lib.ApifyClient()) to interact with the API, avoiding direct shell command execution or risky system calls.
Audit Metadata