The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Instagram via the Apify API and user-pasted content to analyze marketing hooks and profile statistics. This data is interpolated into agent prompts without explicit boundary markers or instructions to ignore embedded commands. The agent possesses capabilities to make network requests to publishing APIs and execute local commands through a user-defined hook, creating a surface where malicious instructions in the fetched content could influence downstream actions. * Ingestion points: lib/apify_client.py fetches captions and metadata from external sources; ig-hook-extractor/SKILL.md accepts pasted text. * Boundary markers: Absent in the provided instructions. * Capability inventory: lib/publora_client.py (Network: api.publora.com); lib/pixfaro_client.py (Network: api.pixfaro.com); lib/backend_selector.py (Subprocess: user-defined command). * Sanitization: Not applied to fetched body text.
[COMMAND_EXECUTION]: The skill includes an extensibility feature that executes a local command specified by the user in the INSTAGRAM_SKILLS_CUSTOM_POSTER environment variable. This command receives JSON data including potentially untrusted captions via stdin. Evidence: lib/backend_selector.py uses subprocess.run to call the user-defined poster script.
[EXTERNAL_DOWNLOADS]: Fetches and sends data to third-party marketing and image generation services. Evidence: Integrates with Apify (api.apify.com) for data retrieval, Publora (api.publora.com) for publishing, and Pixfaro (api.pixfaro.com) for image generation. These are documented integrations providing the skill core functionality.

instagram-marketing