ClawHub
Back to skill

Security audit

Instagram Api

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does what it says, but one Threads script runs undeclared local code before publishing to a social account.

Review before installing. Use only least-privileged posting tokens, run scripts only with final approved media and captions, and assume local media uploaded through the Instagram scripts will also be sent to Imgur as a public URL. Avoid the Threads script until the hardcoded /Users/tomas/.../clean_md.py dependency is removed, bundled, or replaced with reviewed code.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill performs network-capable actions against Meta Graph API and Imgur but does not declare corresponding permissions. This creates a transparency and consent problem because users may invoke a skill that exfiltrates data or posts externally without an explicit permission boundary.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script sends the user-provided video to Imgur as an intermediate hosting step before posting to Instagram, which creates an additional third-party data disclosure path. In a social-posting skill, this is security-relevant because uploaded media may be private, embargoed, or sensitive, and the transfer is not clearly surfaced as a prominent consent step despite the skill being framed primarily as an Instagram API integration.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explains that Imgur is needed, but it does not prominently and plainly warn users that local images or videos will be uploaded as publicly accessible URLs before being sent to Instagram. This can cause unintended disclosure of private media, especially because Imgur anonymous uploads are public-facing and may persist beyond the posting workflow.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script automatically uploads local image files to Imgur before posting, causing potentially sensitive local media to be transmitted to a third-party service without an explicit consent prompt or warning at execution time. In an automation/agent context, this increases the risk of unintentional data disclosure because users may assume media goes only to Instagram via Meta's API.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script begins third-party upload processing without a clear user-facing warning or confirmation that the media will be sent to Imgur public hosting. This can cause unintended disclosure of user content to an external service outside Instagram/Meta, which is especially risky for private or regulated media.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script uploads the user-supplied image to Imgur as an intermediate hosting step before posting to Instagram, but it does not provide an explicit disclosure that the local file will be transmitted to a third-party service outside Meta. This creates a privacy and data-handling risk because users may assume the image is only sent to Instagram, while the file is actually exposed to another external provider with separate retention and access characteristics.

External Transmission

Medium
Category
Data Exfiltration
Content
Instagram Graph API는 공개 URL로만 미디어를 업로드할 수 있어 Imgur가 필요합니다.

1. https://api.imgur.com/oauth2/addclient 접속
2. **Application name**: 원하는 이름 (예: `raon-instagram`)
3. **Authorization type**: `Anonymous usage without user authorization` 선택
4. **Authorization callback URL**: `https://localhost` (Anonymous이므로 형식만 맞추면 됨)
Confidence
90% confidence
Finding
https://api.imgur.com/

External Transmission

Medium
Category
Data Exfiltration
Content
curl "https://graph.facebook.com/v21.0/me/accounts?access_token=YOUR_TOKEN"
   ```

> 💡 **Imgur Client ID**: https://api.imgur.com/oauth2/addclient (Anonymous usage 선택)

---
Confidence
89% confidence
Finding
https://api.imgur.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.