social-scraping
Scrape social media profiles, posts, comments, followers, and search across 20+ platforms via x402. USE FOR: - Getting TikTok, Instagram, YouTube, LinkedIn, X/Twitter, Facebook, or Reddit profiles - Fetching a user's posts, stories, highlights, videos, or transcripts - Getting comments, replies, and reactions on posts - Listing followers and following for any account - Searching posts, hashtags, and profiles across platforms - Scraping ad libraries (Facebook, TikTok, Google, LinkedIn), Facebook Marketplace, Events, and Groups - GitHub users, repos, and trending; Rumble, Threads, Bluesky, Pinterest, Twitch, Spotify, and more - UGC research via the Lightreel agent: hooks, trends, creator search, scripts, briefs - Cross-platform social media research and monitoring TRIGGERS: - "tiktok", "instagram", "facebook", "reddit", "youtube", "linkedin", "twitter" - "get followers", "who follows", "following list" - "scrape profile", "get posts from", "social media data" - "instagram stories", "tiktok videos", "facebook page", "youtube channel" - "ad library", "facebook ads", "tiktok ads", "marketplace" - "ugc", "hooks", "creator search", "content trends" - "cross-platform", "social media research" IMPORTANT: StableSocial uses an async two-step flow. Step 1: POST triggers data collection (paid, $0.06). Step 2: Poll GET /api/jobs/{jobId} (or legacy GET /api/jobs?token=...) until finished (free). All endpoints are $0.06 per call.
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill includes examples that embed a legacy JWT token directly in API responses and in a polling URL (e.g., ?token=eyJ...), which instructs or encourages inserting secret/token values verbatim into CLI commands/requests and therefore poses a high exfiltration risk.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
StableSocial’s required runtime workflow uses a trigger-then-poll pattern to read outsider-authored social content from endpoints like `/api/*/posts`, `/api/*/comment-*`, `/api/*/search`, and durable job polling under `/api/jobs/{jobId}`, which can ingest and return user- or community-submitted text without needing a specific first-party item selection step.
- Repository
- Merit-Systems/agentcash-skills
- Commit
3d657b7
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.