skillify-sh
390b0cc670
Snyk flagged the original skill high-risk: it asked the user to paste their Apify token and told the agent to use it for the rest of the session, which puts a live credential in the transcript and requires the model to hold it verbatim. The browser-login rework had already removed the primary paste path, but a fallback still invited it. Now the skill never asks for a token at all: - Explicit instruction to decline a token if one is offered unprompted. - Headless environments set APIFY_TOKEN out of band, in the user's own shell or CI secret store, before the agent starts -- the preflight then reports AUTH_OK curl and the value never enters the conversation. - 'login -m manual' offered as the alternative, since it reads from stdin. - 'login -t <token>' now discouraged: a secret in argv is visible in the process list and shell history, and it clears the session before validating. - Stated that the token is only ever referenced as $APIFY_TOKEN and expanded by the shell, never substituted as a literal. The agent only ever reads the result of authentication (apify info's exit code), never the credential itself.
Skillify Skills
Dependable agent skills for public social media data.
Every skill here follows the same three rules:
- No logins, ever. Public data only. No skill will ask for your social media password, cookies, or session tokens.
- Tell you the cost before spending your money. Where a skill runs paid infrastructure, it says what a job will cost before it starts, and defaults to small, bounded runs.
- Fail with an answer, not an error. No account? You get onboarding. Rate limited? You get told what happened, in plain words. An empty result is reported as an empty result, not blamed on your billing.
Skills
| Skill | What it does | Needs |
|---|---|---|
instagram-scraper |
Public Instagram profiles, posts, reels, stories, comments, hashtags, locations and mentions | Apify account (free tier works) |
More coming. Each is self-contained — install only what you need.
Install
npx skills add skillify-sh/skills
Or copy any skills/<name>/ directory into your agent's skills directory.
Accounts and cost
Skills that fetch live data run on third-party infrastructure, which needs an account. The skill handles this on first use — it checks for credentials and, if there are none, walks you through getting them. Nothing to configure in advance.
Current provider: Apify. Free to start — $5 of credits every month, no credit card. That covers roughly 2,000 Instagram results per month.
Disclosure
Sign-up links in these skills are referral links. They cost you nothing extra and give you the same free tier. If you would rather not use them, sign up directly at console.apify.com/sign-up — everything works identically.
Privacy
These skills send your query to the data provider and nothing else. They do not log in to any social network, do not send cookies or session tokens, and read only what the network serves to logged-out visitors. Your API tokens stay on your machine.
Requests carry a User-Agent naming the skill, so runs can be told apart in provider
logs. It contains no personal data, and you can remove it.
Contributing
Issues and pull requests welcome. A skill belongs here if it holds to the three rules above.
Licence
MIT — see LICENSE.