Security audit

Instagram Reel Downloader (WhatsApp)

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it runs an unsandboxed browser on a third-party downloader site and accepts broad third-party download links, which makes installation worth review.

Install only if you are comfortable sending Reel URLs to sssinstagram.com and running browser automation in a contained environment. Prefer an isolated container or unprivileged account with no secrets, a dedicated output directory, restricted networking, and cleanup reviewed before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_via_sss.mjs:27
Finding: Chromium Sandbox Disabled for Untrusted Third-Party Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/download_via_sss.mjs:85
Finding: Insufficient Validation and Resource Limits for Attacker-Influenced Downloads
Content: View full analysis
0) { for (let i = 0; i < candidateCount; i++) { const a = directLinkCandidates.nth(i); const href = await a.getAttribute('href'); if (!href) continue; if (!href.startsWith('http')) continue; const filename = `reel-${Date.now()}-${i}.mp4`; const outFile = path.join(OUT_DIR, filename); const resp = await fetch(href, { headers: { 'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36', 'referer': 'https://www.instagram.com/' } }); if (!resp.ok) continue; const ctype = (resp.headers.get('content-type') || '').toLowerCase(); const ab = await resp.arrayBuffer(); const body = Buffer.from(ab); if (!body || body.length < 20_000) continue; if (!(ctype.includes('video') || href.includes('.mp4'))) continue; fs.writeFileSync(outFile, body); mediaPath = outFile; break; } } if (!mediaPath) { const dl = page.locator('a:has-text("Download")').first(); if (await dl.count()) { const [download] = await Promise.all([ page.waitForEvent('download', { timeout: 30000 }).catch(() => null), dl.click().catch(() => null), ]); if (download) { const suggested = download.suggestedFilename() || `reel-${Date.now()}.mp4`; const outFile = path.join(OUT_DIR, suggested.replace(/[^a-zA-Z0-9._-]/g, '_')); await download.saveAs(outFile); mediaPath = outFile; } } } if (!mediaPath || !fs.existsSync(mediaPath)) { throw new Error('DOWNLOAD_FAILE ...[truncated 3115 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/download_via_sss.mjs:8
Finding: Plaintext HTTP Instagram URLs Accepted Contrary to the Documented Input Policy
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description says it downloads and returns an Instagram reel, but the documented behavior also includes local cleanup of files via a shell script, which is outside the core user-visible purpose. This mismatch is dangerous because hidden or under-disclosed destructive filesystem actions reduce operator awareness and can enable accidental deletion of files if paths or retention logic are misconfigured.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
- `node scripts/download_via_sss.mjs "<instagram-url>"`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill declares executable behavior that uses environment variables and network access but does not define any explicit tool scope or permissions boundaries. In an agent environment, this can lead to over-broad execution authority, making it easier for the skill to access unintended resources or perform network actions beyond the expected Instagram download flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script deletes matching media files via find ... -delete, which is a destructive operation. While there is an internal comment describing intent, there is no user-facing prompt, warning, or visible disclosure in this file that files will be permanently removed after the age threshold.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends a user-supplied Instagram reel URL to sssinstagram.com, a third-party service, without any explicit disclosure or consent mechanism in the code path. This exposes user data and browsing intent to an external party and is more sensitive here because the skill's core behavior relies on automated interaction with a non-Instagram site rather than direct first-party retrieval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The code performs outbound network requests to direct media links using fetch and may also trigger browser-managed downloads, but it does not visibly disclose these external transfers to the user. For code files, network operations that transmit or retrieve user-related content should include some user-facing disclosure when not otherwise documented.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code saves downloaded content into a local output directory using fs.writeFileSync and download.saveAs, but the script provides no user-facing disclosure beyond emitting the final file path. For a code file, file writes that affect user storage should have some visible warning, confirmation, or documented notice unless clearly disclosed elsewhere.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/download_via_sss.mjs:16