T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:27- Finding
Mutable Remote Installers Are Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Instagram Downloader
Security checks for vulnerabilities and agentic risk
Overview
This is a real Instagram media downloader, but it handles sensitive Instagram session cookies and installs agent files in broad ways that deserve careful review before use.
Install only if you are comfortable giving this tool access to an Instagram session cookie. Prefer cloning a tagged release and inspecting it instead of running the one-line remote installers. Do not use a sensitive or primary Instagram account, delete ~/.ig-downloader/config.json/settings.json when done, avoid passing sessionid on the command line, and process only trusted Apify/toon data because it controls download URLs and output names.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
instagram_downloader.py:787- Finding
Dataset-Controlled Shortcodes Permit Path Traversal and Arbitrary File Writes
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
instagram_downloader.py:204- Finding
Reusable Instagram Session Credentials Are Persisted in Plaintext Without Explicit Access Controls
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
instagram_downloader.py:706- Finding
Untrusted Dataset URLs Enable Arbitrary Outbound Requests and Unbounded Downloads
- Content
View full analysis
bool: """Download a file with retries. Uses instagrapi for fbcdn.net URLs when available.""" for attempt in range(1, max_retries + 1): try: # ── Try instagrapi first (handles fbcdn.net 403s) ── if insta_helper and insta_helper.is_available(): if insta_helper.download_url(url, filepath): size_kb = os.path.getsize(filepath) / 1024 print(f" [OK] {os.path.basename(filepath)} ({size_kb:.1f} KB)") return True # ── Fallback: plain requests ── resp = requests.get(url, headers={ "User-Agent": DEFAULT_USER_AGENT, "Accept": "*/*", "Referer": "https://www.instagram.com/", }, timeout=60, stream=True, verify=verify) if resp.status_code == 200: os.makedirs(os.path.dirname(filepath), exist_ok=True) with open(filepath, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): f.write(chunk) size_kb = os.path.getsize(filepath) / 1024 print(f" [OK] {os.path.basename(filepath)} ({size_kb:.1f} KB)") return True else: print(f" [HTTP {resp.status_code}] {urlparse(url).path[-40:]}") ``` Dataset fields are used as download sources without host validation: ```python "video_url": video_url, "thumbnail_url": raw.get("thumbnail_url"), ``` ### Technical Analysis Media URLs are accepted from Apify responses or l ...[truncated 2075 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:123- Finding
Installers Resolve Unpinned Dependencies and Fall Back to a Mutable Git Branch
- Content
View full analysis
/dev/null || \ warn "Some dependencies failed. Try: ${pip_cmd} install instagrapi requests" # Install the package itself if [[ -f "$REPO_ROOT/pyproject.toml" ]]; then info "Installing package from local..." $pip_cmd install -e "$REPO_ROOT" 2>/dev/null && { log "Package installed from local source" } || { warn "Local install failed, trying from GitHub..." $pip_cmd install "git+${REPO_URL}" 2>/dev/null && { log "Package installed from GitHub" } || { warn "Package install failed. Try: ${pip_cmd} install git+${REPO_URL}" } } else $pip_cmd install "git+${REPO_URL}" 2>/dev/null && { log "Package installed from GitHub" } || { warn "Package install failed. Try: ${pip_cmd} install git+${REPO_URL}" } fi ``` The project metadata specifies lower bounds rather than reproducible versions: ```toml [build-system] requires = ["setuptools>=68.0"] dependencies = [ "requests>=2.31.0", "instagrapi>=2.0.0", "playwright>=1.48.0", ] ``` ### Technical Analysis The installer requests the latest versions satisfying broad dependency constraints. No lock file, package hashes, signed manifest, or verified constraints file is used. Installation at different times can consequently execute materially different package build and installation code. If local installation fails, the script installs directly from the repository URL without pinning a tag or commit hash. This makes the installed source dependent on the repository's state at installation time. The dependencies appear relevant to the declared functionality, and no evidence showed that the currently named ...[truncated 999 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (59)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - **agents:** replace ASCII decision tree with Mermaid flowchart ([7cd2253](https://github.com/CripterHack/ig-downloader-skill/commit/7cd2253)) - **skill:** replace ASCII architecture with Mermaid diagrams (modes, sessionid flow, setup chain) ([7f4d72e](https://github.com/CripterHack/ig-downloader-skill/commit/7f4d72e)) - **readme:** update README.md to v2.2 — remove login references, add broken login warning, promote Playwright ([9afa78c](https://github.com/CripterHack/ig-downloader-skill/commit/9afa78c)) - **skill:** update SKILL.md to v2.2 — remove login mode, promote sessionid + Playwright setup ([97cf4c9](https://github.com/CripterHack/ig-downloader-skill/commit/97cf4c9)) - bump pyproject.toml to v2.2.0, add playwright dependency ([cb85b59](https://github.com/CripterHack/ig-downloader-skill/commit/cb85b59)) - **agents:** add AGENTS.md with mode selection logic, decision tree, and agent instructions ([88f3793](https://github.com/CripterHack/ig-downloader-skill/commit/88f3793)) - **changelog:** add v2.2.0 entry for Playwright interactive setup ([857fd1c](https://github.com/CripterHack/ig-downloader-skill/commit/857fd1c))
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - **agents:** replace ASCII decision tree with Mermaid flowchart ([7cd2253](https://github.com/CripterHack/ig-downloader-skill/commit/7cd2253)) - **skill:** replace ASCII architecture with Mermaid diagrams (modes, sessionid flow, setup chain) ([7f4d72e](https://github.com/CripterHack/ig-downloader-skill/commit/7f4d72e)) - **readme:** update README.md to v2.2 — remove login references, add broken login warning, promote Playwright ([9afa78c](https://github.com/CripterHack/ig-downloader-skill/commit/9afa78c)) - **skill:** update SKILL.md to v2.2 — remove login mode, promote sessionid + Playwright setup ([97cf4c9](https://github.com/CripterHack/ig-downloader-skill/commit/97cf4c9)) - bump pyproject.toml to v2.2.0, add playwright dependency ([cb85b59](https://github.com/CripterHack/ig-downloader-skill/commit/cb85b59)) - **agents:** add AGENTS.md with mode selection logic, decision tree, and agent instructions ([88f3793](https://github.com/CripterHack/ig-downloader-skill/commit/88f3793)) - **changelog:** add v2.2.0 entry for Playwright interactive setup ([857fd1c](https://github.com/CripterHack/ig-downloader-skill/commit/857fd1c))
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - **skill:** update SKILL.md to v2.1 — login mode with 2FA, challenge handling, saved sessions, 4-mode architecture ([af6e105](https://github.com/CripterHack/ig-downloader-skill/commit/af6e105)) - **changelog:** add v2.0.0 entry — sessionid mode, setup wizard, config management, Chrome cookie extraction ([e352843](https://github.com/CripterHack/ig-downloader-skill/commit/e352843)) - **readme:** rewrite README.md for v2.0 — sessionid quick-start, three-mode comparison, setup wizard, cookie extraction guide ([b0ada50](https://github.com/CripterHack/ig-downloader-skill/commit/b0ada50)) - **skill:** rewrite SKILL.md for v2.0 — sessionid mode, setup wizard, three-mode architecture, config management ([4e91ce8](https://github.com/CripterHack/ig-downloader-skill/commit/4e91ce8)) - **script:** update docstring for v2.0 three-mode architecture (sessionid, Apify, setup) ([19129ee](https://github.com/CripterHack/ig-downloader-skill/commit/19129ee)) - remove backup files, add to .gitignore ([5e26048](https://github.com/CripterHack/ig-downloader-skill/commit/5e26048)) - add unit tests for parser, normalizer, and filter logic ([5c1991f](https://github.com/CripterHack/ig-downloader-skill/commit/5c1991f))
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
| bashis a direct code-execution chain from a remote network source to a shell interpreter. This is dangerous because it removes any user review barrier and allows arbitrary command execution if the fetched content is altered or the source is compromised.- Content
bash # Option A — Universal installer (recommended) curl -fsSL https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash # Option B — From source git clone https://github.com/cripterhack/ig-downloader-skill.git
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This is the same high-risk chaining behavior in another location. Within an agent-skill ecosystem, a malicious installer could not only execute arbitrary code locally but also plant persistent skill instructions into agent directories for follow-on abuse.
- Content
bash # Linux / macOS / Git Bash curl -fsSL https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash # Windows PowerShell iex (iwr -Uri https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.ps1).Content
YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]
High
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
ithubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash
Windows PowerShell
iex (iwr -Uri https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.ps1).Content
text This installs both the Python CLI **and** the AI agent skill files (SKILL.md). After this, your AI agent can discover and use the skill automatically. ### Manual install (pip only) ```bash pip install git+https://github.com/cripterhack/ig-downloader-skill.git ig-downloader --helpFrom source
bash git clone https://github.com/cripterhack/ig-downloader-skill.git cd ig-downloader-skill pip install -e . python instagram_downloader.py --helpAgent-specific install
bash # Install only for Codex CLI (not auto-detect) ./install.sh --agent codex # Install only in current project directory ./install.sh --project # Install for ALL supported agents ./install.sh --agent all
🤖 AI Agent Integration
This project is a dual-layer tool: a Python CLI
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documentation promises a no-password-sharing, session-based downloader, but it also describes direct login flows, 2FA/challenge handling, browser cookie extraction, and persistence of authentication material. This mismatch is dangerous because users may consent to a limited media-download function while the skill actually accesses and stores highly sensitive credentials and browser-resident secrets.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documentation promises a no-password-sharing, session-based downloader, but it also describes direct login flows, 2FA/challenge handling, browser cookie extraction, and persistence of authentication material. This mismatch is dangerous because users may consent to a limited media-download function while the skill actually accesses and stores highly sensitive credentials and browser-resident secrets.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation promises a no-password-sharing, session-based downloader, but it also describes direct login flows, 2FA/challenge handling, browser cookie extraction, and persistence of authentication material. This mismatch is dangerous because users may consent to a limited media-download function while the skill actually accesses and stores highly sensitive credentials and browser-resident secrets.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code reads Chrome's cookie database, retrieves the browser encryption key, and decrypts the Instagram sessionid from the user's local profile. A session cookie is equivalent to an authenticated account token, so silent extraction of it can enable account takeover or unauthorized reuse without the user's informed consent.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh # ./install.sh --agent all # # # One-liner (auto-downloads repo) # curl -fsSL https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash # # # Via npx (if skills.sh registry is enabled) # npx skills add cripterhack/ig-downloader-skill
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module generates changelogs, bumps versions, updates pyproject.toml and CHANGELOG.md, stages files with git, and writes GitHub Actions outputs. None of these operations implement downloading Instagram reels, photos, or carousel media, so the actual behavior of this file diverges from the manifest's stated skill purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file states in Spanish that the instructions are for an OpenCoder subagent to invoke the script correctly, and the document is written as Spanish-first operational guidance without any opt-in or language-choice statement. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation unless justified or optionalized.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to extract and save an Instagram sessionid locally but does not clearly warn that this token is equivalent to account session access and should be protected like a password. Storing such a token without explaining its sensitivity increases the risk of account compromise if the file is exposed, synced, or read by other local processes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instructions describe falling back to Chrome cookie extraction, which expands the skill from a downloader into local browser credential/session harvesting. Extracting cookies from a user's browser can expose authenticated session tokens far beyond the narrow stated purpose, and the behavior is not prominently justified or bounded in the skill description.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Including Chrome cookie extraction as a setup capability is risky because it accesses sensitive browser-stored authentication material unrelated to simple media downloading. That creates an unnecessary credential-access pathway that could be abused to obtain or persist Instagram sessions without adequate user understanding.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 73% confidence
- Finding
Although the specific match is noisy, the surrounding changelog context repeatedly documents saved sessions, config management, and cookie extraction for authenticated Instagram access. Persisting session tokens in local config/settings without explicit mention of secure storage, permission hardening, encryption, or lifecycle controls can expose reusable account credentials to other local processes or users.
- Content
md - **readme:** update README.md to v2.1 — login mode, authentication docs, updated FAQ ([a160c42](https://github.com/CripterHack/ig-downloader-skill/commit/a160c42)) - **skill:** update SKILL.md to v2.1 — login mode with 2FA, challenge handling, saved sessions, 4-mode architecture ([af6e105](https://github.com/CripterHack/ig-downloader-skill/commit/af6e105)) - **changelog:** add v2.0.0 entry — sessionid mode, setup wizard, config management, Chrome cookie extraction ([e352843](https://github.com/CripterHack/ig-downloader-skill/commit/e352843)) - **readme:** rewrite README.md for v2.0 — sessionid quick-start, three-mode comparison, setup wizard, cookie extraction guide ([b0ada50](https://github.com/CripterHack/ig-downloader-skill/commit/b0ada50)) - **skill:** rewrite SKILL.md for v2.0 — sessionid mode, setup wizard, three-mode architecture, config management ([4e91ce8](https://github.com/CripterHack/ig-downloader-skill/commit/4e91ce8)) - **script:** update docstring for v2.0 three-mode architecture (sessionid, Apify, setup) ([19129ee](https://github.com/CripterHack/ig-downloader-skill/commit/19129ee)) - remove backup files, add to .gitignore ([5e26048](https://github.com/CripterHack/ig-downloader-skill/commit/5e26048))
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The changelog advertises browser-based login and direct extraction of Instagram session cookies without any accompanying warning that these tokens are sensitive credentials equivalent to account access. In the context of an agent skill that may be invoked by users or automation, normalizing credential capture without clear consent and handling guidance increases the risk of unsafe use, credential leakage, or misuse of a personal account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This entry specifically highlights automatic Chrome cookie extraction and decryption, which describes access to browser-stored authentication material. Even though this is only changelog text, for a credential-oriented downloader skill this signals functionality that can directly access sensitive tokens; absent an explicit warning or consent boundary, it materially raises the risk of unauthorized credential access and misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README instructs users to execute remote installation scripts directly via
curl ... | bashand PowerShelliexwithout any warning, review step, checksum, or signature verification. This is dangerous because any compromise of the hosting account, repository, branch, network trust boundary, or script contents can immediately lead to arbitrary code execution on the user's machine.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README normalizes capture and storage of an Instagram
sessionidcookie but does not clearly state that this cookie is an authentication secret equivalent to account access. If disclosed via logs, config files, screenshots, backups, or agent/tool output, an attacker could reuse it to access the account until expiry or revocation.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Check if skill files exist ls ~/.config/opencode/skills/instagram-downloader/SKILL.md # Check if the CLI works ig-downloader --version
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares broad capabilities in practice—environment access, file reads/writes, network use, and shell-like behavior—without an explicit permissions or allowed-tools section. In an agent ecosystem, missing scope declarations reduce transparency and informed consent, making it easier for a user or orchestrator to invoke sensitive behaviors unintentionally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to extract and persist an Instagram sessionid cookie but does not provide a prominent warning that this cookie is effectively an authenticated bearer credential. If exposed through logs, config files, backups, or agent telemetry, an attacker could hijack the Instagram session and access the user's account within the session's privileges.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill describes polling and decrypting Chrome's cookie database to obtain browser-stored Instagram credentials, but it does not present a strong privacy/security warning or explicit consent boundary. Accessing browser credential stores is highly sensitive because it can harvest active authenticated sessions, and in an agent context it materially increases the risk of credential theft or misuse beyond the user's expected action of downloading media.
- Content
Static analysis
No suspicious patterns detected.