Insta Content Engine

This skill's features align with its description, but it mishandles credentials and metadata is misleading. Before installing: - Expect to provide OPENAI_API_KEY, BRAVE_API_KEY, and IG_USERNAME/IG_PASSWORD (the registry incorrectly lists none). Treat these as sensitive. - Do not run it on a multi-user or shared machine: instagram-post.js builds a python -c command that contains your username/password in the command text, which can be visible to other local users via ps/psaux and logs. Better approaches are to use environment variables passed securely, a temporary file with restrictive permissions, or a proper OAuth/session flow. - Inspect and control the ~/.openclaw directory: the skill will try to read ~/.openclaw/clawdbot.json for keys and will write ~/.openclaw/ig_session.json (containing session info). Review and remove saved session files when no longer needed and rotate passwords if used. - If you need to run this, prefer running in an isolated VM/container, or modify instagram-post.js to invoke a short Python script file (not inline) and avoid embedding credentials in command lines. - Confirm you trust the OpenAI key usage (image generations incur cost) and that storing IG credentials in a script/session fits your security posture. If you want, ask for a secure remediation checklist (minimal code edits to avoid credential exposure) or for a specific code change to reduce the risks identified.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.