File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:61
Security audit
Instagram Scraper API - Posts, Profiles, Reels
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed Scavio integration for reading public Instagram data through an API key, with no hidden code or persistence found.
Before installing, confirm you are comfortable giving the skill access to your Scavio API key and using paid or limited credits to retrieve public Instagram data such as comments, follower lists, and active stories. Use it for user-requested research and respect applicable platform, privacy, and legal constraints.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal