Instagram Skill via cyberdrk/gram CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for an Instagram CLI, but it asks users to run an unpinned third-party package with Instagram session-cookie access and live account-action capability.

Review this before installing. Only use it if you trust the npm package publisher and are comfortable giving the CLI access to Instagram session cookies or a specific browser profile. Prefer a pinned, verified version, avoid storing cookies in plaintext config, and treat like/comment/follow commands as immediate live account actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:4

Finding

Execution of an Unpinned Third-Party Package with Access to Instagram Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4-19
Vulnerability Type: Unverified and unpinned third-party dependency execution
Risk Level: High

yaml

homepage: https://github.com/arein/gram
metadata: {"clawdbot":{"emoji":"📸","requires":{"bins":["gram"]},"install":[{"id":"npm","kind":"node","package":"@cyberdrk/gram","bins":["gram"],"label":"Install gram (npm)"}]}}
---

# gram 📸

Instagram CLI using REST/GraphQL API + cookie auth.

## Install

```bash
# npm/pnpm/bun
npm install -g @cyberdrk/gram

# One-shot (no install)
bunx @cyberdrk/gram whoami

text

### Technical Analysis

The skill directs users and supporting automation to install or immediately execute `@cyberdrk/gram` without specifying an immutable version, integrity hash, lockfile, or verified source revision. As a result, package resolution can select whatever release is current at execution time, allowing the effective code to change after this skill has been reviewed.

The package is installed globally through npm or executed directly through `bunx`. Both methods run third-party package code with the permissions of the invoking user. This is especially sensitive because the documented purpose of the package requires access to Instagram session cookies, manually supplied authentication tokens, or browser cookie databases.

The declared homepage belongs to the GitHub account `arein`, while the npm package uses the `cyberdrk` scope. The supplied project contains no source code, checksum, package lock, provenance statement, or other evidence that establishes the relationship between these identities or permits verification of the installed implementation. This discrepancy is not proof that the package is malicious, but it prevents the dependency from being independently validated from the audited artifact.

### Attack Path

1. A user or agent follows the installation instructions in `SKILL.md`.
2. npm or Bun resolves the muta
...[truncated 1393 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific audited version rather than resolving the latest release.
2. Record and verify the package integrity digest using a lockfile or equivalent immutable integrity mechanism.
3. Verify and document the ownership relationship between the declared GitHub repository and the npm package scope.
4. Include the package source in the review scope or provide a reproducible build process that maps the reviewed source revision to the published npm artifact.
5. Avoid global installation and unrestricted bunx execution. Prefer a project-local, locked dependency executed in a restricted environment.
6. Disable unnecessary package lifecycle scripts during installation when supported.
7. Isolate execution using a dedicated low-privilege operating-system account or sandbox, and grant access only to the specific browser profile or credential material required.
8. Prefer short-lived or revocable authentication credentials and avoid exposing unrelated browser-cookie databases.
9. Add package provenance verification, release-signing checks, and automated monitoring for unexpected ownership or artifact changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

ble) --chrome-profile # Chrome profile name --chrome-profile-dir # Chrome/Chromium profile dir or cookie DB path --firefox-profile # Firefox profile --timeout # Request timeout --cookie-timeout # Cookie extraction timeout

text

## Config File

`~/.config/gram/config.json5` (global) or `./.gramrc.json5` (project):

```json5
{
  cookieSource: ["safari", "chrome"],
  chromeProfile: "Profile 1",
  timeoutMs: 60000
}

Environment variables: GRAM_TIMEOUT_MS, GRAM_COOKIE_TIMEOUT_MS

Troubleshooting

Query IDs stale (404 errors)

bash

gram query-ids --refresh

Cookie extraction fails

• Check browser is logged into Instagram
• Try different --cookie-source
• For Arc/Brave: use --chrome-profile-dir
• Provide cookies manually: --session-id, --csrf-token, --ds-user-id

User-agent mismatch errors

• The CLI uses desktop user-agent by default
• If your session was created on mobile, it may fa

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs users to provide Instagram session cookies directly or extract them from local browser profiles, which are highly sensitive authentication secrets. Even though this appears intended for legitimate account access, presenting these mechanisms without an explicit warning about secret handling, scope of access, and leakage risk can lead users to expose reusable credentials that grant account access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill lists commands that perform real state-changing Instagram actions such as like, comment, follow, and unfollow, but does not clearly warn that these affect the live account immediately. In an agent or automation context, this can cause unintended account activity, reputation damage, spam-like behavior, or policy violations if users assume the commands are read-only demonstrations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.