ClawHub

instagram-saver

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Instagram downloader that openly uses Cobalt, with ordinary privacy and safe-input cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable sharing the Instagram link with Cobalt. Use it for public or non-sensitive links, avoid providing Instagram credentials or cookies, and ensure the agent validates the URL as an Instagram link and constructs the curl request safely rather than blindly shell-interpolating unusual input.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The skill activates on any Instagram link with no clear scope limits, exclusions, or confirmation step. Broad triggers increase the chance that normal user content is automatically processed and sent into a download workflow, which can cause unintended handling of third-party URLs and privacy-sensitive content.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to send user-provided Instagram URLs to an external service without an explicit warning or consent step. Even if the submitted value is 'just a URL', it still discloses user activity and requested content to a third party, creating a privacy and data-sharing risk.

External Transmission

Medium
Category
Data Exfiltration
Content
執行以下 `curl` 指令（請將 `{url}` 替換為實際連結）：

```bash
curl -X POST [https://api.cobalt.tools/api/json](https://api.cobalt.tools/api/json) \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -d '{"url": "{url}"}'
Confidence
91% confidence
Finding
curl -X POST [https://api.cobalt.tools/api/json](https://api.cobalt.tools/api/json) \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
當使用者提供 Instagram 網址（`url`）時，請準備執行 `curl` 指令。我們將使用 Cobalt API 來獲取真實的媒體下載連結。

**API Endpoint:** `https://api.cobalt.tools/api/json`
**Header:** `Content-Type: application/json`
**Header:** `Accept: application/json`
**Body:** `{"url": "{url}"}`
Confidence
93% confidence
Finding
https://api.cobalt.tools/

External Transmission

Medium
Category
Data Exfiltration
Content
執行以下 `curl` 指令（請將 `{url}` 替換為實際連結）：

```bash
curl -X POST [https://api.cobalt.tools/api/json](https://api.cobalt.tools/api/json) \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -d '{"url": "{url}"}'
Confidence
91% confidence
Finding
https://api.cobalt.tools/

External Transmission

Medium
Category
Data Exfiltration
Content
執行以下 `curl` 指令（請將 `{url}` 替換為實際連結）：

```bash
curl -X POST [https://api.cobalt.tools/api/json](https://api.cobalt.tools/api/json) \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -d '{"url": "{url}"}'
Confidence
91% confidence
Finding
https://api.cobalt.tools/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal