Security audit

Instagram Post Comments

Security checks across malware telemetry and agentic risk

Overview

This skill is a real Instagram comment scraper, but it includes under-disclosed API collection and explicit rate-limit evasion guidance that users should review carefully.

Install only if you are comfortable with an authenticated Instagram scraping workflow that uses internal API calls and may collect user identifiers. Avoid using the stealth-session or rate-limit distribution guidance, and use it only for posts and data you are authorized to collect and handle.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill claims it only reads data already visible to the user, but its actual method is to call Instagram internal APIs and paginate through comment data programmatically. That mismatch is dangerous because it conceals a materially more powerful collection mechanism that can access structured data at scale, including content not gathered via ordinary manual viewing.

Description-Behavior Mismatch

Low

Confidence: 90% confidence
Finding: The manifest says the skill fetches comment text, usernames, timestamps, like counts, and reply counts, but the documented outputs also include identifiers and post metadata such as user_id and media_id. This is a scope-expansion issue that increases privacy and compliance risk because the actual data collected exceeds what the user is told.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill explicitly recommends opening multiple stealth browser sessions with independent fingerprints to increase throughput and distribute rate limits. This is a classic anti-detection and anti-rate-limit evasion pattern that materially increases the capability for large-scale scraping and abuse beyond a normal user workflow.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documentation asserts that it does not bypass controls and only reads on-screen data, yet elsewhere it instructs use of internal APIs and stealth techniques to avoid anti-scraping restrictions. This contradiction is dangerous because it attempts to normalize or disguise behavior that is more invasive and likely intended to circumvent platform defenses.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to write and execute bash scripts and append to a local memory file without explicit warning about filesystem modification or shell execution side effects. This is dangerous because it expands the operational impact from passive data retrieval to persistent local changes and command execution, increasing the chance of unintended system modification or abuse.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script performs a direct network request to Instagram and returns comment text, usernames, user IDs, timestamps, and engagement metadata without any built-in consent, disclosure, access control, or privacy guardrails. Even if the data is publicly accessible, aggregating and exposing identifiable user data through a scraping skill can enable privacy abuse, profiling, or collection beyond user expectations.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The instructions normalize anti-scraping evasion by recommending scaling via multiple sessions and independent fingerprints. Even if framed as efficiency guidance, this teaches operators how to bypass platform defenses and makes the skill substantially more suitable for abusive collection than for ordinary one-off user assistance.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.