Insta Content Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:28 AM UTC
• Version: 1.0.0

Overview

This skill’s social posting purpose is mostly disclosed, but it handles live account credentials and sessions while shipping exploitable command-generation patterns that should be reviewed before installation.

Review this skill carefully before installing. Use it only in an isolated environment with dedicated low-privilege social accounts, rotate any credentials used, avoid passing untrusted queries or action values, and require a manual preview/confirmation before any post is published.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/viral-search.js:75

Finding

Shell Command Injection Through the X Search Query

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/instagram-post.js:68

Finding

Python Code Injection Through the Instagram Action Argument

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Remediation

View remediation

--hash=sha256: Pillow== --hash=sha256: ``` ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'req' from os.environ.get (line 42, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gen_image.py (reported line 53)May include surrounding context.

python

print(f"Generating image ({size})...")
try:
    resp = urllib.request.urlopen(req, timeout=120)
    result = json.loads(resp.read())
    b64 = result["data"][0]["b64_json"]
    with open(output, "wb") as f:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undisclosed reliance on external APIs and incomplete description of actual behavior can mislead users about data flows, costs, and account exposure. In security terms, hidden dependencies and omitted external-service interactions reduce informed consent and make risky operations easier to trigger unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undisclosed reliance on external APIs and incomplete description of actual behavior can mislead users about data flows, costs, and account exposure. In security terms, hidden dependencies and omitted external-service interactions reduce informed consent and make risky operations easier to trigger unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undisclosed reliance on external APIs and incomplete description of actual behavior can mislead users about data flows, costs, and account exposure. In security terms, hidden dependencies and omitted external-service interactions reduce informed consent and make risky operations easier to trigger unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undisclosed reliance on external APIs and incomplete description of actual behavior can mislead users about data flows, costs, and account exposure. In security terms, hidden dependencies and omitted external-service interactions reduce informed consent and make risky operations easier to trigger unexpectedly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents use of networked tools and environment-based credentials, but it declares no explicit tool scope or allowed-tools policy. That omission can cause overbroad execution in agent environments, making it easier for the skill to access network resources or secrets without clear user visibility or platform enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to place sensitive API keys and account credentials in environment variables but gives no guidance on secure handling, storage, rotation, or least privilege. This raises the risk of credential leakage through logs, process inspection, shell history, or overly broad agent access to env vars.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

1. **NEVER just put text on a solid dark background** — it looks flat and amateur
2. **ALWAYS use a photographic/cinematic background** — real scenes, real subjects
3. **ALWAYS use dark gradient overlay** on the lower 40% for text readability
4. **Keep subject visible** in the top 60% — face, setting, context
5. **Text lives in the bottom 40% only** — never cover the subject
6. **Use bold condensed typography** (Anton-style) — not regular weight fonts

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill provides direct commands for publishing to live X/Twitter and Instagram accounts without an explicit safety warning or confirmation requirement. In an agent setting, that increases the chance of accidental posting, reputational harm, disclosure of sensitive information, or unwanted actions on behalf of the user.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gen_image.py (reported line 43)May include surrounding context.

python

}).encode()

req = urllib.request.Request(
    "https://api.openai.com/v1/images/generations",
    data=data,
    headers={
        "Content-Type": "application/json",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a skill for finding trends, generating social graphics, and posting to Instagram/X without paid APIs, but it does not indicate that the implementation will collect account credentials from environment variables or command-line flags. Handling raw credentials is a more sensitive capability than the stated purpose alone implies, especially since the script also persists authenticated session state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script stores an authenticated Instagram session to a local file under the user's home directory, creating durable account-state material that can be reused if the file is read by another local process or user. In a skill marketed mainly as social posting automation, silently persisting reusable session state increases the blast radius of compromise beyond a one-time login and can enable unauthorized posting or account access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script accesses both environment credentials and a local OpenClaw config file to obtain a Brave API key, which expands its access beyond a narrowly scoped Instagram search helper. In an agent-skill context, reading unrelated local configuration can expose secrets from the host environment and creates unnecessary secret-discovery behavior that could be abused or repurposed if the skill is modified or combined with other components.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill that can 'find trending topics' in general, but this file's trending implementation only searches three fixed topic areas: crypto, DeFi, and AI trading. That materially narrows and biases the behavior relative to the broader claim in the description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code explicitly uses toLocaleDateString('en-GB', ...), which hard-codes a specific locale in user-visible output. This is a natural-language/locale policy concern because users are not offered a choice or informed that output formatting will be forced to British English conventions.

Content

No source excerpt is available for this finding.