Instagram Collector Adarsh
v1.0.1Collects Instagram profile metrics for a handle using Apify, returning followers, posts, engagement rate, posting frequency, avg likes/comments, and top hash...
⭐ 0· 280·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name and SKILL.md consistently describe an Instagram profile collector that uses Apify; requesting an Apify actor run is coherent with that purpose. However, the registry metadata declares no required environment variables while the SKILL.md explicitly requires an APIFY_API_TOKEN for authentication — this mismatch is unexpected and should be corrected/clarified.
Instruction Scope
SKILL.md stays within scope: it describes calling the Apify actor, polling for completion, mapping fields, calculating metrics, and returning structured data. It references apifyService.ts, EMPTY_INSTAGRAM_DATA, and a Winston logger, but none of those implementation files are included in the skill bundle — so the runtime behavior depends on out-of-band code. The instructions also reference the APIFY_API_TOKEN environment variable (not listed in the declared requirements). There are no instructions to read unrelated system files or to send data to endpoints other than Apify.
Install Mechanism
This is an instruction-only skill with no install spec and no bundled code, so nothing will be downloaded or written by the skill itself. That reduces install-time risk, but also means the actual API-calling code lives elsewhere (the skill assumes an existing apifyService implementation).
Credentials
The SKILL.md requires an APIFY_API_TOKEN to call Apify, which is a proportionate credential for this purpose. However, the skill metadata lists no required env vars — an inconsistency that could lead to misconfiguration or accidental token exposure. Also, error logging is specified with Winston and includes handle and err details; ensure logs cannot accidentally contain sensitive token data or other secrets.
Persistence & Privilege
The skill does not request persistent presence (always:false) and does not declare any privileged system access or config-path requirements. It also does not attempt to modify other skills or global agent configuration in the instructions.
What to consider before installing
This skill appears to do what it says (use Apify to scrape public Instagram profiles), but there are a few things to check before installing:
- Ensure you provide an APIFY_API_TOKEN to the runtime (SKILL.md requires it) — the registry metadata incorrectly declares no env vars. Don't paste your token into logs or shared output.
- Because no code files are bundled, verify the actual apifyService implementation the agent will call: confirm it uses the official Apify API endpoint, handles the actor run/dataset retrieval correctly, and does not call unexpected external endpoints.
- Review error logging to make sure sensitive values (tokens, internal URIs) are not included in structured logs; consider redaction.
- Confirm the referenced actor ID (apify~instagram-profile-scraper) is the expected Apify actor and that you accept the estimated per-run cost and rate limits.
If you cannot inspect or control the apifyService implementation and token handling, avoid installing or run it in a restricted/test environment first.Like a lobster shell, security has layers — review code before you run it.
latestvk9717w3644yzqyc3myx11vk1k982fxza
License
MIT-0
Free to use, modify, and redistribute. No attribution required.