The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill exposes a customMapFunction input parameter described as a 'JavaScript function to transform each output object.' This allows the inclusion of arbitrary JavaScript strings which are passed to the remote execution environment of the Apify actor. While this is a feature of the underlying platform, it represents a surface for dynamic code injection.
[COMMAND_EXECUTION]: The documentation provides multiple examples of executing a local script node scripts/run_actor.js. Although the script content is not provided in the analyzed file, the skill instructs the agent and user to execute shell commands to trigger the scraping logic and handle output files (CSV/JSON).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from Instagram.
Ingestion points: Data is pulled from Instagram profiles, reels, and posts (captions, comments, etc.) via the apidojo/instagram-scraper actor in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between the scraped content and its own processing instructions.
Capability inventory: The skill possesses the ability to run shell scripts (node scripts/run_actor.js) and perform analysis based on the retrieved data.
Sanitization: No sanitization, filtering, or escaping mechanisms are mentioned for the text retrieved from Instagram captions or comments before they are analyzed for content themes and sentiment.

analyzing-competitor-instagram-content-strategy