ClawHub
Back to skill

Security audit

instagram-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent and disclosed, but its helper can send authenticated Crawlora requests beyond the documented read-only Instagram endpoints.

Review before installing if you will use a real Crawlora API key. The normal documented use is public Instagram lookup, but the bundled helper should be tightened to GET-only exact endpoint shapes to avoid accidental or caller-influenced authenticated requests outside the documented surface.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crawlora.sh:41
Finding
Overbroad HTTP Method and Route Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 41–65 **Vulnerability Type**: Overbroad API capability exposure **Risk Level**: Medium ### Vulnerable Code ```bash # This skill's helper is limited to its documented Crawlora route set. Keep # caller-account surfaces and unrelated API routes out of the helper even if # someone supplies an undocumented path directly. case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the instagram-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the instagram-research skill" >&2 exit 2 ;; esac case "$path" in /instagram/post/*/*) ;; /instagram/profile/*) ;; /instagram/reels/*) ;; *) echo "path is not in the instagram-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis The documented API surface contains three read-only endpoints: - `GET /instagram/post/{id}/{post_id}` - `GET /instagram/profile/{username}` - `GET /instagram/reels/{id}` However, the helper permits both `GET` and `POST`. Consequently, an invocation using `-X POST` passes local validation even though no supported endpoint is documented as accepting POST requests. The path allowlist also uses unrestricted shell wildcards. In shell pattern matching, `*` can match slash characters, so these patterns do not enforce the expected number of path segments. For example, paths such as `/instagram/profile/user/extra` and `/instagram/post/id/post/extra` can pass the allowlist. The script therefore enforces route prefixes rather than exact endpoint shapes. The API origin is fixed to `https://api.crawlora.net/api/v1`, so this issue does not allow an attacker to redirect the API key to an arbitrary host. Exploitability instead depends on whether Crawlora exposes undocumented POST handlers or nested routes beneath the accepted ...[truncated 1397 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Restrict the helper to the only documented HTTP method: ```bash if [ "$method" != "GET" ]; then echo "only GET is supported by the instagram-research skill" >&2 exit 2 fi ``` 2. Replace wildcard-prefix validation with exact route-shape validation. Validate each endpoint separately and reject extra path segments. For example, use Bash regular expressions with identifier-specific character sets: ```bash if [[ "$path" =~ ^/instagram/profile/[A-Za-z0-9._]+$ ]]; then route="profile" elif [[ "$path" =~ ^/instagram/reels/[0-9]+$ ]]; then route="reels" elif [[ "$path" =~ ^/instagram/post/[0-9]+/[0-9]+$ ]]; then route="post" else echo "path is not in the instagram-research skill catalog" >&2 exit 2 fi ``` 3. Enforce endpoint-specific query parameters. Permit `max_id` only for the Reels endpoint and reject query arguments for profile and post lookups unless the documented API contract changes. 4. Continue retaining the existing fixed API origin, API-key character validation, private temporary configuration file, and rejection of curl `@file` query syntax. 5. Add regression tests covering unsupported methods, empty identifiers, encoded separators, duplicate slashes, additional path segments, and undocumented query parameters. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill invokes a shell helper (`scripts/crawlora.sh`) but does not declare any tool restrictions such as `permissions` or `allowed-tools`. That creates an unnecessary trust gap: an agent may be allowed broader shell execution than needed, increasing the chance of unintended command execution or abuse if the skill is modified or combined with untrusted input.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
87% confidence
Finding
This markdown file documents calls to an external API and explicitly requires the `x-api-key: $CRAWLORA_API_KEY` header, but it does not warn users that the skill transmits request data to a third-party service or that an API credential is required. Under the markdown-specific warning criteria, external-network behavior and credential use that may affect privacy or system integrity should be disclosed.

Static analysis

No suspicious patterns detected.