Security audit

Instagram Account Operations

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Instagram operations playbook, but it handles private messages and can optionally send identifiable recap details to a webhook.

Install only for Instagram accounts you own or are authorized to operate. Keep the webhook empty unless the destination is trusted and access-controlled, and redact handles or sensitive lead details before enabling external alerts. Review local memory files periodically and enforce the stated 90-day retention.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:18
Finding: Unredacted Personal and Lead Data May Be Transmitted to Third-Party Webhooks
Content: View full analysis
/memory/ig-recaps.md` always, to the webhook only if you opted in. ``` ```markdown ## YYYY-MM-DD HH:MM TZ — — status: ok|partial|blocked|skipped - Phase: A|B - DMs handled: - Comments handled: - Hot leads: - Escalated to human: - Blockers: - Next useful action: <1 line> ``` ```markdown ## 2026-07-16 21:00 Europe/Paris — ig-dm-check — status: partial - Phase: A - DMs handled: 3 - Comments handled: — - Hot leads: @marc_r (licence suspension, asked for a callback) - Escalated to human: 1 (@sofia.k asked to speak to a person) - Blockers: comment tab hit the Reply-navigation bug once (exit 4) - Next useful action: reply to @sofia.k manually before 10:00 ``` ### Technical Analysis When webhook alerts are enabled, the skill sends the recap verbatim to a Telegram, Slack, or Discord endpoint. The recap format permits Instagram handles, lead classifications, inquiry subjects, escalation details, and operational notes. The documented example associates an identifiable handle with a potentially sensitive legal issue. Although webhook de ...[truncated 1852 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.
md
- [ ] Account Status (MBS → Settings) green, no warning.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The configuration example hard-codes timezone: Europe/Paris, which is a locale-specific default in natural language guidance. The file does not indicate that users should choose their own timezone or that the skill is intended only for a Paris-region deployment, so it can be read as forcing a specific locale without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.