Instagram API

PassAudited by ClawScan on May 9, 2026.

Overview

This instruction-only skill transparently calls agntdata's Instagram API with your API key; the main things to watch are credential handling and the optional external plugin install.

This skill appears coherent for accessing Instagram data through agntdata. Before installing or using it, make sure you trust agntdata with your API usage, keep AGNTDATA_API_KEY secret, watch credit/billing usage, and review the separate plugin package if you decide to install it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can make agntdata API requests using your key, which may consume account credits or expose permitted account usage if the key is mishandled.

Why it was flagged

This shows the skill depends on a sensitive account credential for authenticated agntdata API calls.

Skill content

The API key should be available as the `AGNTDATA_API_KEY` environment variable. Every request must include it as a Bearer token:

Recommendation

Use the key only in trusted environments, avoid pasting it into chat when possible, do not log it, monitor usage, and revoke or rotate it if exposed.

Low

#ASI02: Tool Misuse and Exploitation

What this means

API calls and their parameters are sent to agntdata and may change the activation state of the API key or consume credits during use.

Why it was flagged

The skill directs use of raw curl/API calls, including a one-time registration endpoint. This is central to the API-wrapper purpose and is disclosed, but it still performs authenticated remote actions.

Skill content

curl -X POST https://api.agntdata.dev/v1/register \

Recommendation

Review the endpoint and parameters before running calls, especially the registration request and any high-volume data queries.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the recommended plugin may add executable code, native MCP tools, and automatic authentication behavior beyond what was reviewed in this skill.

Why it was flagged

The skill recommends installing an external plugin package that is not included in the provided instruction-only artifact set.

Skill content

openclaw plugins install @agntdata/openclaw-instagram

Recommendation

If you choose the plugin route, review the plugin package, publisher, permissions, and source separately before installing.