Security audit

Keyapi Instagram Content Discovery

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Instagram content-discovery skill, but it needs review because it stores API tokens and fetched social data locally while exposing a broader generic MCP runner than the Instagram-only purpose suggests.

Review before installing. Use a least-privilege KeyAPI token, avoid running it on shared machines, keep the skill directory out of source control, and regularly delete .env and .keyapi-cache contents if they contain data you do not want retained. Treat exported results as potentially sensitive social-media data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The runner accepts arbitrary tool names, supports tool enumeration, and allows schema inspection against the remote MCP server, which expands capability beyond the claimed Instagram discovery purpose. In a skill context, this increases the attack surface and can be abused to invoke unintended remote actions or access data through other available tools if the connected token is overprivileged.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs users to cache API responses locally and the documented responses include comments, replies, likes, captions, locations, and other user-generated engagement data. Persisting that data to `.keyapi-cache/` without retention limits, access controls, redaction guidance, or privacy warnings can create unintended local data exposure and compliance risk, especially on shared systems or developer workstations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: API responses are written to a local cache by default, which can persist potentially sensitive or proprietary fetched data without explicit operator awareness. On shared systems or poorly secured workstations, cached content may be exposed to other users, backups, or later unintended reuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script prompts for an API token and persists it in a plaintext .env file automatically, without requiring explicit consent or warning about local credential storage. Plaintext token storage materially increases the risk of credential theft via source control mistakes, local compromise, backups, or other users on the same machine.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The --output option writes full API responses to an arbitrary file path, which can result in sensitive data being stored in insecure or unintended locations. While this is user-driven, the absence of warnings or guardrails makes accidental disclosure more likely in automation and shared environments.

Static analysis

No suspicious patterns detected.