instagram-post-generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.0

Overview

The skill is a cloud Instagram-post generator, but one documented CLI path asks users to run an unpinned npm tool with their API key, so it needs review before installation.

Install only if you are comfortable sending prompts, uploaded images, and design configuration to the listed external services and receiving shareable workspace/image URLs. Prefer the documented HTTPS API call over the unpinned `npx` command, or pin and verify the CLI package before running it, and use a limited or disposable API key where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:421

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:421-422
Vulnerability Type: Supply-chain exposure from unpinned package execution
Risk Level: Medium

Vulnerable Code

bash

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key
npx onekey agent craftsman-agent/craftsman-agent social_media_posts '{"prompt":"Movie Odyssey Main Characters Introduction,"images":[],"card_count":1,"template_id":"social-media-carousel","api_id":"image_generator","asset_size":[{"width":1080,"height":1080,"ratio":"1:1"}],"mode":"basic","session_id":"31d57eb9-9a37-4808-9c5b-1bfbb2abf5fb","session_name":"AI Poster of MCPs/CLIs/Agents","tag_list":"","model":"default","styles":["Editorial grid layout with corporate dark deep monochromatic tones"],"design_config":{"template_id":"social-media-carousel","card_count":1,"card_count_source":"default","channel_profile":"generic","audience_profile":"general","age_band":"auto","profile_version":"1.0.0","geometry_source":"profile","resolved_profiles":[{"type":"channel","id":"generic","version":"1.0.0"},{"type":"audience","id":"general","version":"1.0.0"}],"language":"auto","mode":"standard","text_model":"default","image_model":"default","styles":["Editorial grid layout with corporate dark deep monochromatic tones"],"constraints":["Limit target output build to 6 high-density pages max for physical double folding print"],"brief_inputs":[{"id":"binp-1","type":"prompt","content":"Introduction to Difference between MCPs,Skills and Agents CLIs"},{"id":"binp-2","type":"style","content":"Editorial grid layout with corporate dark deep monochromatic tones"},{"id":"binp-3","type":"constraint","content":"Limit target output build to 6 high-density pages max for physical double folding print"},{"id":"binp-1786857754660","type":"prompt","content":"Custom newly configured prompt parameter specifications instructions layout metric..."}],"text_styles":{"brand":{"color":"#8b5cf6","font":"Playfair Display","font_size":"20px","font_weight"
...[truncated 3881 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin onekey to a reviewed exact version rather than resolving the latest compatible release:

   bash

   npx --yes onekey@X.Y.Z agent craftsman-agent/craftsman-agent social_media_posts '...'
   

2. Document the expected npm registry, package publisher, package name, version, and provenance so users can verify that they resolved the intended artifact.
3. Use a project manifest and lockfile with integrity metadata instead of relying on ad hoc npx retrieval. Commit the reviewed lockfile to the project.
4. Verify package signatures or npm provenance attestations where supported, and validate integrity before execution.
5. Run the CLI in a restricted container or sandbox with only the files and network destinations required for generation.
6. Avoid placing the API key in a broadly inherited shell environment. Supply a short-lived, least-privilege credential to the isolated process and rotate it if exposure is suspected.
7. Disable lifecycle scripts during installation where compatible with the package and workflow, then invoke only the reviewed entry point.
8. Establish a dependency-update review process so version changes require security inspection before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation demonstrates that user prompts, uploaded images, generated content, and resulting workspace links are sent to third-party services and may be exposed through shareable URLs, but it does not clearly warn users about those privacy and publication implications. This can cause unintentional disclosure of sensitive data because users may assume inputs remain local or private when they are actually transmitted externally and potentially accessible through shared workspaces.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill explicitly instructs users to send content to an external endpoint using an API key, which means prompts, images, and design configuration are transmitted outside the local trust boundary. In this skill's context that behavior is expected for functionality, but it is still security-relevant because the documentation does not adequately constrain or warn about what data should not be sent, how it is handled, or the exposure created by returned share URLs.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

bash

export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -X POST "https://agent.deepnlp.org/agent_router" \
-H "Content-Type: application/json" \
-H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
-d '{

Static analysis

No suspicious patterns detected.