SocialKit Instagram Post

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 6:58 AM UTC
• Version: 0.3.1

Overview

The skill publishes approved Instagram posts using disclosed Meta credentials, with no hidden execution or unrelated data transfer found.

Review the account, caption, and media before approving each post. Protect the stored Meta tokens and app secret, skip Threads setup for Instagram-only use, and assess the separate authentication and approval skills before installing them. This review covered every bundled file through static inspection; live API behavior and companion implementations were not tested.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Facebook authentication can support Instagram Graph API access and is not inherently a mismatch. However, the separate Threads authentication flow targets an undeclared platform and is not explained by the Instagram-only purpose. The absence of publishing, validation, or approval logic in this setup-only chunk is not itself evidence of a mismatch.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

3. `node scripts/publish.mjs --check --dir ig-<slug>`

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

5. `node scripts/publish.mjs --publish --dir ig-<slug>`. Report the permalink and the

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 29)May include surrounding context.

md

1. https://developers.facebook.com/apps > Create app > type **Business**.
2. Add **Facebook Login for Business**. Under its settings add your redirect URL to
   **Valid OAuth Redirect URIs** (exact match, Strict Mode on).
3. Optional but recommended: create a Login configuration (User access token) with the
   permissions below, and set its ID as `META_LOGIN_CONFIG_ID`. Without it the auth script
   requests the permissions by scope.
4. Permissions used: `pages_show_list`, `pages_read_engagement`, `pages_manage_posts`,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish.mjs (reported line 553)May include surrounding context.

js

function defaultHint(error) {
  switch (error.code) {
    case 190:
      return "The access token is expired or invalid. Re-run the auth script for this platform.";
    case 4:
    case 17:
    case 32:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.