The Agent Skills Directory

[SAFE]: The skill demonstrates strong security maturity by implementing restrictive file system permissions (umask 0o077 and chmod 0o600) for its local SQLite database and sensitive configuration files, ensuring data isolation.
[SAFE]: A centralized governance manager (governance.py) implements a mandatory 2-step confirmation process for all high-risk actions, including publishing content, sending direct messages, and managing comments, preventing accidental or malicious autonomous actions.
[SAFE]: The database layer (db.py) uses parameterized SQL queries throughout, effectively mitigating risks associated with SQL injection.
[SAFE]: The skill proactively protects against CSV injection (formula injection) by using a utility (csv_utils.py) that neutralizes potentially dangerous cell prefixes like '=', '+', '-', and '@' in exported data.
[DATA_EXFILTRATION]: To comply with Instagram Graph API requirements, the skill uploads local media files to Imgur to generate public URLs. While this involves sending local data to an external service, it is a functional requirement for the API and is protected by the governance layer requiring user approval before execution.
[PROMPT_INJECTION]: The skill ingests untrusted data from external sources (Instagram direct messages and comments), creating a surface for indirect prompt injection.
Ingestion points: scripts/messages.py and scripts/comments.py fetch external text content into the agent context.
Boundary markers: No explicit delimiter-based boundary markers were identified in the text processing scripts.
Capability inventory: The skill possesses capabilities for network operations (httpx), database writes, and file exports.
Sanitization: Content exported to CSV is sanitized for formula injection, though natural language content is processed as-is.

instagram