social-media-research-skills

Least-privilege permissions

• Limit API access: Only grant the AI agent permission to read/view social media data; block write access (posting, messaging, deleting) unless absolutely required.
• Use temporary credentials: Generate short-lived API keys that expire after a few hours or days instead of permanent access tokens that work indefinitely.
• Separate accounts per platform: Create dedicated read-only accounts for each social media platform (TikTok, Instagram, LinkedIn, etc.) so a breach on one doesn't compromise all platforms.
• Disable unnecessary features: Turn off agent capabilities for features you don't need—if you only need post analysis, disable comment mining or user profile scraping.

Network isolation

• Run on private infrastructure: Deploy the agent on internal company servers or isolated cloud environments rather than public-facing systems; avoid running it on shared hosting.
• Restrict outbound connections: Configure firewalls to only allow the agent to connect to specific social media APIs and block all other internet destinations.
• Use a proxy or VPN: Route all agent requests through a corporate proxy server to mask your company's IP address and prevent platform IP bans affecting your organization.
• Segregate from sensitive systems: Keep the agent completely separate from networks containing customer databases, financial records, or internal employee data.

Monitoring

• Log all scraping activity: Record what data was collected, when, from which platforms, and how many requests were made—review logs weekly for unusual patterns.
• Alert on rate-limit hits: Set up automated notifications when the agent receives warnings or blocks from platforms, as this signals aggressive scraping that may violate Terms of Service.
• Track data volumes: Monitor how much data is being downloaded and stored; sudden spikes could indicate a compromise or misconfiguration.
• Audit credential usage: Regularly review which team members or systems have access to API keys, and immediately revoke access when employees leave.

Red flags to watch for

• Sudden account suspensions: If your scraping accounts get banned from platforms without warning, stop operations and review your activity—you may be violating their policies.
• Unexpected prompts in results: If scraped posts or comments contain strange commands or links trying to manipulate the AI (like "ignore your instructions"), isolate the agent and escalate to your security team immediately.
• IP blocks or captchas: When platforms start blocking your requests or demanding verification, stop scraping—continuing will trigger permanent bans.
• Data breaches in the news: If the AI tool provider (ScrapeCreators) or a platform you're scraping reports a security incident, assume your credentials may be compromised and rotate all API keys and passwords.