clinstagram

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:44 AM UTC
• Version: 0.2.0

Overview

This Instagram agent CLI is mostly coherent, but it needs Review because its advertised compliance modes can be bypassed and its media URL handling can make unsafe network requests.

Install only if you are comfortable letting an agent operate an Instagram account, including private API actions when credentials exist. Until fixed, do not rely on official-only mode as a hard boundary if agents can pass --backend private, avoid giving the skill untrusted media URLs, and clear stored sessions with auth logout when private API access should no longer be available.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/clinstagram/commands/_dispatch.py:162

Finding

Forced Backend Selection Bypasses Compliance Policy Enforcement

Content

View full analysis

Vulnerability Details

File Location: src/clinstagram/commands/_dispatch.py:162-169
Vulnerability Type: Compliance policy and access-control bypass
Risk Level: Medium

Vulnerable Code

python

# Force backend override
forced = ctx.obj.get("backend")
if forced and forced.value != "auto":
    backend_name = forced.value
else:
    router = _get_router(ctx)
    backend_name = router.route(feature)

if backend_name is None:

Technical Analysis

Automatic backend selection passes through Router.route(), which applies both capability checks and compliance-policy restrictions. In contrast, an explicitly supplied backend, such as --backend private, is accepted directly without verifying:

• Whether the selected backend is allowed by the configured compliance mode.
• Whether the backend advertises support for the requested feature.
• Whether private API access is prohibited under official-only.
• Whether the requested private operation is restricted under hybrid-safe.

This means the documented official-only guarantee of “Graph API only” is not enforced when a backend override is supplied. The separate growth-action gate protects only certain actions, such as follow, unfollow, like, unlike, and comment creation. It does not provide general enforcement for all private API operations or all mutations.

Attack Path

1. A user configures the Skill in official-only or hybrid-safe mode.
2. A private API session remains present in the OS keychain.
3. An agent or user invokes a command with --backend private.
4. dispatch() assigns backend_name directly from the forced option.
5. Router.route() and its compliance checks are skipped.
6. _instantiate_backend() loads the stored private session.
7. The requested private API operation executes despite the configured restriction.

Impact Assessment

The bypass allows use of an unofficial Instagram private API out ...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

• Route both automatic and explicit backend selections through one policy-enforcement function.
• Add a public router method that accepts a requested backend and verifies both can_backend_do(backend, feature) and compliance-mode authorization.
• Reject a forced private backend under official-only.
• Under hybrid-safe, permit the private backend only for features explicitly included in READ_ONLY_FEATURES.
• Return ExitCode.POLICY_BLOCKED for compliance violations and ExitCode.CAPABILITY_UNAVAILABLE when the selected backend does not implement the feature.
• Consider deleting or disabling private sessions when switching to official-only, or clearly offer that as an option.
• Add regression tests covering forced private selection for every compliance mode, including mutation and read-only operations.

A safe structure would resemble:

python

router = _get_router(ctx)
forced = ctx.obj.get("backend")

if forced and forced.value != "auto":
    backend_name = router.route_forced(feature, forced.value)
else:
    backend_name = router.route(feature)

route_forced() must reject the request unless both the capability matrix and compliance policy authorize it.

T09 · Insecure Skill Coding Practices

Warning

• Location: src/clinstagram/media.py:47

Finding

Unrestricted Media URL Retrieval Enables SSRF and Memory Exhaustion

Content

View full analysis

Vulnerability Details

File Location: src/clinstagram/media.py:47-55
Vulnerability Type: Server-Side Request Forgery and ineffective download-size enforcement
Risk Level: Medium

Vulnerable Code

python

if _is_url(source):
    if needs_url:
        return source

    # Download to a temp file for the private backend
    response = httpx.get(source, follow_redirects=True, timeout=30.0)
    response.raise_for_status()
    if len(response.content) > MAX_DOWNLOAD_BYTES:
        raise ValueError(f"Media too large: {len(response.content)} bytes (max {MAX_DOWNLOAD_BYTES})")

    # Infer extension from URL path
    parsed = urlparse(source)

Technical Analysis

The media source is user-controlled and can contain any HTTP or HTTPS URL. Before downloading, the implementation does not reject:

• Loopback addresses.
• Private network ranges.
• Link-local addresses.
• Cloud metadata endpoints.
• Reserved or multicast ranges.
• Hostnames that resolve to internal addresses.
• Redirects whose destination resolves to a prohibited address.

Because follow_redirects=True is enabled, even an initially public URL can redirect to an internal service. This creates an SSRF primitive whenever a URL is staged for the private backend.

The 100 MB limit does not effectively constrain memory consumption. Accessing response.content causes httpx to buffer the complete response before its length is checked. A remote server can therefore return a body substantially larger than the configured limit and consume process memory before rejection.

Attack Path

SSRF path:

1. An attacker influences a media argument processed by an agent.
2. The supplied value is an HTTP(S) URL targeting an internal address, metadata endpoint, or public redirector.
3. The private backend requires a local media file, causing resolve_media() to download the URL.
4. httpx.get() connects to the target and f ...[truncated 1264 chars]

Remediation

View remediation

Remediation Suggestions

• Permit HTTPS by default and require an explicit option for plain HTTP.
• Resolve the hostname before connecting and reject every IP in loopback, private, link-local, reserved, unspecified, and multicast ranges.
• Revalidate DNS resolution and the destination of every redirect; do not rely only on validating the original URL.
• Set a small maximum redirect count or disable automatic redirects and process each redirect explicitly.
• Use httpx.stream() and write the response incrementally.
• Stop reading immediately when the accumulated byte count exceeds MAX_DOWNLOAD_BYTES.
• Reject an excessive Content-Length before reading, while retaining streaming enforcement because that header is optional and untrusted.
• Apply separate connect, read, write, and pool timeouts.
• Consider a domain allowlist where the workflow permits it.
• Add tests for direct and redirected access to 127.0.0.1, RFC 1918 ranges, IPv6 loopback, link-local ranges, and oversized chunked responses.

Example bounded-download logic should count chunks before writing:

python

total = 0
with httpx.stream("GET", source, follow_redirects=False, timeout=timeout) as response:
    response.raise_for_status()
    with tempfile.NamedTemporaryFile(suffix=suffix, delete=False) as tmp:
        for chunk in response.iter_bytes():
            total += len(chunk)
            if total > MAX_DOWNLOAD_BYTES:
                raise ValueError("Media exceeds the maximum download size")
            tmp.write(chunk)

Destination validation must occur before this request and again for each redirect.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (82)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 249)May include surrounding context.

│ TOML config, rate limits, compliance │ ├─────────────────────────────────────────────┤ │ Secrets │ │ OS Keychain (macOS/Linux/Windows) │ │ Fallback: encrypted file for CI │ └─────────────────────────────────────────────┘

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as an Instagram operations CLI, but the analyzed behavior is described as primarily media path/URL handling, HTTP downloads, and temporary file management. Hidden or under-disclosed file and download behavior increases the risk of SSRF, unsafe remote content fetching, and unintended local file exposure because operators may not realize the skill retrieves URLs and manipulates local temp files.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as an Instagram operations CLI, but the analyzed behavior is described as primarily media path/URL handling, HTTP downloads, and temporary file management. Hidden or under-disclosed file and download behavior increases the risk of SSRF, unsafe remote content fetching, and unintended local file exposure because operators may not realize the skill retrieves URLs and manipulates local temp files.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · docs/plans/2026-03-06-clinstagram-design.md (reported line 254)May include surrounding context.

md

2. Open OAuth URL → user grants permissions (content publishing, comments, insights)
3. Exchange code for long-lived token (60-day)
4. Probe capabilities → cache in `capabilities.json`
5. Store token in keychain

**Facebook Login (`clinstagram auth connect-fb`):**
1. Prompt for Meta App ID + confirm linked Facebook Page

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-clinstagram-design.md (reported line 259)May include surrounding context.

md

**Facebook Login (`clinstagram auth connect-fb`):**
1. Prompt for Meta App ID + confirm linked Facebook Page
2. Open OAuth URL → user grants extended permissions (messaging, webhooks)
3. Exchange code for long-lived token + Page access token
4. Probe capabilities (including Messaging API) → cache
5. Store tokens in keychain

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 69)May include surrounding context.

Run:

bash

rm -rf src/clinstagram/__pycache__
pip install -e ".[dev]"

Expected: Install succeeds, clinstagram --help works.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The plan explicitly directs rewriting SKILL.md, which is a form of self-modification of the agent skill's own behavior and metadata. In a skill context, self-updating documentation or instructions can be abused to broaden claimed capabilities, weaken safety messaging, or mislead downstream agents about what the skill does.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 1428)May include surrounding context.

Files:

• Rewrite: SKILL.md

Step 1: Update SKILL.md to match v2 design

yaml

---

Self-Modification

High

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

Committing an updated SKILL.md as part of the automated plan operationalizes the self-modification risk by persisting changed skill metadata. Because the file defines user-facing capabilities and operating assumptions, allowing the skill to alter it can undermine trust and safety controls.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 1520)May include surrounding context.

bash

git add SKILL.md
git commit -m "docs: update SKILL.md to match v2 design with compliance modes"

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 36)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 615)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 617)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 628)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 629)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 638)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 639)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 647)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 648)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 658)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 681)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/plans/2026-03-06-phase1-implementation.md (reported line 1134)May include surrounding context.

md

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · pyproject.toml (reported line 14)May include surrounding context.

toml

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/clinstagram/auth/keychain.py (reported line 15)May include surrounding context.

python

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/clinstagram/auth/keychain.py (reported line 17)May include surrounding context.

python

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/clinstagram/auth/keychain.py (reported line 28)May include surrounding context.

python

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/clinstagram/auth/keychain.py (reported line 29)May include surrounding context.

python

"tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "pydantic>=2.6.0",
    "keyring>=25.0.0",
]

[project.optional-dependencies]

Static analysis

No suspicious patterns detected.