Security audit

insta-post

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can publish from a real logged-in Instagram account without a final confirmation or account check.

Install only if you are comfortable with an agent using your already logged-in Instagram browser session to publish posts. Confirm the active Instagram account, images, and caption yourself before running it, and be aware that there is no built-in final approval step.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code substantially matches the main declared purpose of automating Instagram post uploads through a browser connected to an existing session. It uploads images, enters a caption, and shares the post on Instagram. However, the description explicitly claims collaborator tagging support, and there is no code that searches for collaborator/tagging UI, enters collaborator usernames, or confirms invite/tag actions. This is a material description-to-behavior mismatch for that capability. No other significant undeclared capabilities are present beyond normal implementation details like file existence checks, browser connection, and login verification.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill drives a logged-in browser session to publish content but does not declare any explicit tool scope or allowed tools. That omission weakens review and containment, making it easier for the skill to access capabilities beyond what a user or platform expects during execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs an agent to click through and publish an Instagram post from an already authenticated account without a clear warning that this action will make content publicly visible. In the context of social-media automation, missing an explicit consent/visibility warning is dangerous because it can cause unintended public posting, reputational harm, or accidental disclosure from the user's real account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions hard-code Korean UI labels such as "만들기", "다음", and "공유하기" without documenting locale assumptions or fallback behavior. In browser automation for a destructive/public action, locale-specific selectors increase the chance of misclicks or failed verification, which can cause the agent to interact with the wrong element in a live authenticated session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs a real public Instagram post submission immediately after receiving CLI inputs, with no explicit confirmation step, dry-run mode, or pre-action warning at the point of execution. In the context of a browser session already authenticated to Instagram, accidental invocation, parameter misuse, or chaining by another tool can cause unintended public posting to a real account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Most documentation, errors, warnings, and CLI descriptions are written in Korean, which imposes a locale/language choice on users of the skill. The file does not indicate that Korean is optional or that the skill is intentionally restricted to a Korean-speaking context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.