Instagram Reel Downloader (WhatsApp)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 1.0.1

Overview

The skill does what it says, but it runs an unsandboxed browser on a third-party downloader site and accepts broad third-party download links, which makes installation worth review.

Install only if you are comfortable sending Reel URLs to sssinstagram.com and running browser automation in a contained environment. Prefer an isolated container or unprivileged account with no secrets, a dedicated output directory, restricted networking, and cleanup reviewed before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_via_sss.mjs:27
• Finding: Chromium Sandbox Disabled for Untrusted Third-Party Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download_via_sss.mjs`, lines 27-31 **Vulnerability Type**: Browser sandbox disabled **Risk Level**: High ### Vulnerable Code ```js const browser = await chromium.launch({ executablePath, headless: true, args: ['--no-sandbox', '--disable-dev-shm-usage'] }); ``` ### Technical Analysis The script launches Chromium with the `--no-sandbox` argument and then navigates to the third-party website `sssinstagram.com`. The Chromium sandbox is a defense-in-depth boundary designed to restrict the filesystem, process, and operating-system access available to a compromised browser renderer. Disabling this protection substantially increases the consequences of a browser vulnerability triggered by malicious advertisements, compromised third-party resources, or a compromised downloader website. The `--disable-dev-shm-usage` option does not create the same security risk, but it does not compensate for the disabled sandbox. ### Attack Path 1. An attacker compromises `sssinstagram.com`, one of its dependencies, or third-party content rendered by the website. 2. The script starts Chromium with `--no-sandbox`. 3. Chromium loads the attacker-controlled browser content. 4. The attacker exploits a suitable Chromium or renderer vulnerability. 5. Because the process sandbox is disabled, the exploit has fewer containment barriers and may access resources available to the account running the downloader. ### Impact Assessment Successful exploitation would operate with the privileges of the user account running this Skill. Depending on the runtime configuration, this could expose the Agent workspace, downloaded media, environment variables accessible to the process, and other files readable or writable by that account. The code does not itself grant root privileges, so host-wide administrative compromise is not established. However, the missing sandbox significantly increases the potential scope of a browser compr ...[truncated 12 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `--no-sandbox` Chromium argument and retain Chromium's standard process sandbox. - Run the downloader as a dedicated, unprivileged operating-system account. - Do not expose secrets or unrelated workspace files to the browser process. - If the deployment environment cannot support Chromium sandboxing, execute the complete downloader in a separately isolated container or virtual machine with: - A read-only root filesystem. - A dedicated writable output directory. - No host filesystem mounts beyond those strictly required. - No credentials or sensitive environment variables. - Restricted outbound networking. - CPU, memory, process, and execution-time limits. - Keep Chromium patched because the workflow intentionally renders remote, untrusted web content. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download_via_sss.mjs:85
• Finding: Insufficient Validation and Resource Limits for Attacker-Influenced Downloads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download_via_sss.mjs`, lines 85-140 **Vulnerability Type**: Untrusted URL fetching and inadequate downloaded-content validation **Risk Level**: Medium ### Vulnerable Code ```js const directLinkCandidates = page.locator('a[href*="cdn"], a[href*=".mp4"], a:has-text("Download")'); const candidateCount = await directLinkCandidates.count(); let mediaPath = ''; if (candidateCount > 0) { for (let i = 0; i < candidateCount; i++) { const a = directLinkCandidates.nth(i); const href = await a.getAttribute('href'); if (!href) continue; if (!href.startsWith('http')) continue; const filename = `reel-${Date.now()}-${i}.mp4`; const outFile = path.join(OUT_DIR, filename); const resp = await fetch(href, { headers: { 'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36', 'referer': 'https://www.instagram.com/' } }); if (!resp.ok) continue; const ctype = (resp.headers.get('content-type') || '').toLowerCase(); const ab = await resp.arrayBuffer(); const body = Buffer.from(ab); if (!body || body.length < 20_000) continue; if (!(ctype.includes('video') || href.includes('.mp4'))) continue; fs.writeFileSync(outFile, body); mediaPath = outFile; break; } } if (!mediaPath) { const dl = page.locator('a:has-text("Download")').first(); if (await dl.count()) { const [download] = await Promise.all([ page.waitForEvent('download', { timeout: 30000 }).catch(() => null), dl.click().catch(() => null), ]); if (download) { const suggested = download.suggestedFilename() || `reel-${Date.now()}.mp4`; const outFile = path.join(OUT_DIR, suggested.replace(/[^a-zA-Z0-9._-]/g, '_')); await download.saveAs(outFile); mediaPath = outFile; } } } if (!mediaPath || !fs.existsSync(mediaPath)) { throw new Error('DOWNLOAD_FAILE ...[truncated 3115 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Parse candidates using `new URL(href)` rather than string-prefix checks. - Require `url.protocol === "https:"`. - Restrict downloads to a documented allowlist of expected media hostnames. - Validate every redirect target instead of validating only the initial URL. - Resolve destination hostnames and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges. Repeat this validation for redirect destinations and account for DNS rebinding. - Apply explicit connection, response-header, idle, and total download timeouts. - Stream the response to disk rather than loading the entire response into memory. - Abort the transfer when a strict maximum media size is exceeded. - Require an approved video MIME type; do not accept a file merely because its URL contains `.mp4`. - Verify media magic bytes and parse the resulting container with a trusted media inspection tool before treating it as a video. - Apply the same URL, size, MIME, and content checks to the Playwright download fallback. - Generate a fixed server-side filename and create it exclusively to avoid overwriting an existing file. - Delete partial or rejected downloads immediately. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/download_via_sss.mjs:8
• Finding: Plaintext HTTP Instagram URLs Accepted Contrary to the Documented Input Policy<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download_via_sss.mjs`, lines 8-11 **Vulnerability Type**: Inadequate URL scheme validation **Risk Level**: Low ### Vulnerable Code ```js if (!/^https?:\/\/(www\.)?instagram\.com\/(reel|reels)\//i.test(url)) { console.error('ERROR=INVALID_URL'); process.exit(3); } ``` The documented policy in `SKILL.md`, lines 20-21, states: ```md 1. Validate input URL. - Accept only `https://www.instagram.com/reel/...` (or `/reels/...`) links. ``` ### Technical Analysis The regular expression uses `https?`, so both HTTPS and plaintext HTTP URLs are accepted. It also permits the bare `instagram.com` hostname even though the documentation specifies `www.instagram.com`. Allowing HTTP contradicts the declared input policy and permits the supplied Reel URL to use an unencrypted transport if it is subsequently dereferenced by the third-party service or another component. Regex-based URL validation is also less robust than parsing the URL and checking each component explicitly. In this implementation, the URL is entered into an HTTPS page rather than directly fetched by the Node.js process. Therefore, direct plaintext transport by this script is not conclusively demonstrated. The confirmed issue is that unsafe input outside the documented contract is accepted and passed into the external workflow. ### Attack Path 1. A user or upstream component provides an `http://www.instagram.com/reel/...` URL. 2. The `https?` regular expression accepts the URL. 3. The plaintext URL is submitted to the third-party downloader page. 4. If that URL is dereferenced over HTTP by the external service or a downstream component, a network-positioned attacker could observe or modify the request or its redirection behavior. ### Impact Assessment The issue weakens transport guarantees and causes implementation behavior to diverge from the documented policy. Potential exposure is limited to the supplied Reel URL and any behavior ...[truncated 157 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the regular expression with structured URL parsing and explicit checks. For example: ```js let parsed; try { parsed = new URL(url); } catch { console.error('ERROR=INVALID_URL'); process.exit(3); } const validHost = parsed.hostname === 'www.instagram.com'; const validPath = /^\/reels?\/[^/]+\/?$/i.test(parsed.pathname); if ( parsed.protocol !== 'https:' || !validHost || !validPath || parsed.username || parsed.password || parsed.port ) { console.error('ERROR=INVALID_URL'); process.exit(3); } ``` Additionally: - Decide whether query strings and fragments are necessary and reject or strip them when they are not required. - Keep the implementation and `SKILL.md` input policy synchronized. - Add tests covering HTTP URLs, lookalike domains, credentials in URLs, unexpected ports, malformed URLs, and unsupported paths. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill description says it downloads and returns an Instagram reel, but the documented behavior also includes local cleanup of files via a shell script, which is outside the core user-visible purpose. This mismatch is dangerous because hidden or under-disclosed destructive filesystem actions reduce operator awareness and can enable accidental deletion of files if paths or retention logic are misconfigured.

Ae1

High

• Category: analysis-evasion

Content

- `node scripts/download_via_sss.mjs "<instagram-url>"`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares executable behavior that uses environment variables and network access but does not define any explicit tool scope or permissions boundaries. In an agent environment, this can lead to over-broad execution authority, making it easier for the skill to access unintended resources or perform network actions beyond the expected Instagram download flow.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script deletes matching media files via `find ... -delete`, which is a destructive operation. While there is an internal comment describing intent, there is no user-facing prompt, warning, or visible disclosure in this file that files will be permanently removed after the age threshold.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends a user-supplied Instagram reel URL to sssinstagram.com, a third-party service, without any explicit disclosure or consent mechanism in the code path. This exposes user data and browsing intent to an external party and is more sensitive here because the skill's core behavior relies on automated interaction with a non-Instagram site rather than direct first-party retrieval.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The code performs outbound network requests to direct media links using fetch and may also trigger browser-managed downloads, but it does not visibly disclose these external transfers to the user. For code files, network operations that transmit or retrieve user-related content should include some user-facing disclosure when not otherwise documented.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code saves downloaded content into a local output directory using fs.writeFileSync and download.saveAs, but the script provides no user-facing disclosure beyond emitting the final file path. For a code file, file writes that affect user storage should have some visible warning, confirmation, or documented notice unless clearly disclosed elsewhere.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/download_via_sss.mjs:16