Instagram

• Outcome: Review
• Latest audit: Sep 15, 2026 · 4:06 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Instagram read connector, but its broad routing instruction and unverified remote installer commands need review before use.

Review the installer path before installing: prefer a signed or checksum-verified oo CLI installation method rather than the pipe-to-shell commands. Use the skill only when you intend to process Instagram professional-account data through OOMOL, and avoid relying on it for unrelated Instagram browsing or tasks that do not need the connected account.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:59
• Finding: Unverified Remote Shell Script Execution During CLI Installation## Vulnerability Details **File Location**: `SKILL.md:59` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external server and pipes it directly into `bash`. No release version is pinned, and no cryptographic signature or checksum is verified before execution. HTTPS protects the connection in transit but does not establish that the current server-side script is the same script that was reviewed. Installation may be necessary when the CLI is unavailable, but immediate execution of an unauthenticated remote payload is not the minimum-safe mechanism. The effective code can change after the Skill has been audited. ### Attack Path 1. The `oo` command is unavailable, causing the first-time setup instructions to be used. 2. An attacker compromises the installer host, hosting account, DNS resolution, TLS termination infrastructure, or release process. 3. The attacker replaces or alters `install.sh`. 4. `curl` retrieves the altered response. 5. The pipe sends the response directly to `bash` without an inspection or verification boundary. 6. The malicious script executes with the privileges of the user running the command. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The payload could read or modify files accessible to that user, access environment variables and local credentials, install additional software, alter shell configuration, or establish persistence where the user's permissions permit it. If the command is run from an elevated shell, the impact may extend to system-wide compromise.
• Remediation: ## Remediation Suggestions - Replace the pipe-to-shell command with a pinned, versioned release obtained from an official release repository. - Download the installer to a local file without executing it. - Verify a vendor-published cryptographic signature or a checksum delivered through an independently trusted channel. - Review the downloaded file before execution and run it as a separate step. - Document the files, permissions, and configuration changes made by the installer. - Run installation without administrative privileges unless a specific operation demonstrably requires elevation. - Prefer a signed operating-system package or trusted package manager where available.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Unverified Remote PowerShell Execution During CLI Installation## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Remote payload retrieval and immediate PowerShell evaluation **Risk Level**: High **Complete Code Snippet**: ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `Invoke-RestMethod` retrieves mutable PowerShell content from an external URL and pipes it directly to `Invoke-Expression`. `Invoke-Expression` evaluates the response as executable PowerShell code. The instruction provides no version pinning, Authenticode validation, detached signature verification, checksum validation, or opportunity to inspect the payload before execution. Consequently, the content executed on a user's Windows system may differ from the content available when the Skill was reviewed. ### Attack Path 1. The `oo` command is unavailable on a Windows host. 2. The user or agent follows the documented first-time installation procedure. 3. An attacker compromises the remote installer, its delivery infrastructure, or its release process. 4. `Invoke-RestMethod` downloads attacker-controlled PowerShell content. 5. The pipeline passes that content directly to `Invoke-Expression`. 6. PowerShell executes the payload with the invoking process's privileges. ### Impact Assessment Successful exploitation permits arbitrary PowerShell and operating-system command execution as the current user. This can expose user-accessible files, browser or application data, environment variables, and credentials. It can also modify the user's profile and configuration or establish user-level persistence. Execution from an elevated PowerShell session could result in system-wide modification or compromise.
• Remediation: ## Remediation Suggestions - Do not pipe network responses to `Invoke-Expression`. - Publish a versioned and Authenticode-signed installer or signed package. - Download the installer to disk, verify its signer and expected hash, inspect it, and execute it in a separate command. - Pin documentation to a specific reviewed release rather than a mutable generic installer URL. - State whether elevation is needed and avoid administrator execution unless strictly necessary. - Prefer a trusted Windows package distribution mechanism with signature enforcement.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3
• Finding: Unconditional Routing of Instagram Requests Through a Third-Party Connector## Vulnerability Details **File Location**: `SKILL.md:3-16` **Vulnerability Type**: Agent instruction and tool-routing hijacking **Risk Level**: Medium **Complete Code Snippets**: ```yaml description: "Instagram (instagram.com). Use this skill for ANY Instagram request — searching and reading data. Whenever a task involves Instagram, use this skill instead of calling the API directly." ``` ```markdown Operate **Instagram** through your OOMOL-connected account. This skill calls the `instagram` connector with the [oo CLI](https://github.com/oomol-lab/oo-cli); OOMOL injects credentials server-side, so you never handle raw tokens. ``` Related network invocation: ```bash oo connector run "instagram" --action "<action_name>" --data '<json>' --json ``` ### Technical Analysis The Skill instructs the agent to use it for any Instagram-related request and explicitly directs the agent away from calling the API directly. This broad routing rule is not limited to requests that require an OOMOL-connected account. Connector actions necessarily send the selected action and supplied JSON payload through the OOMOL service. Returned Instagram account, media, or analytics data also passes through that service. The reviewed file states that credentials are injected server-side and does not instruct the agent to collect raw tokens; however, it does not describe data retention, privacy handling, or require explicit consent before routing request data through the third party. ### Attack Path 1. A user makes an Instagram-related request. 2. The broad Skill description causes the agent to select this Skill regardless of whether the OOMOL connector is necessary. 3. The agent constructs an action and JSON payload using `oo connector run`. 4. The request payload is transmitted to OOMOL for execution against the connected Instagram account. 5. Instagram account, media, or insight results are returned through OOMOL. 6. Reque ...[truncated 605 chars]
• Remediation: ## Remediation Suggestions - Narrow activation to requests for which the user explicitly chooses the OOMOL Instagram connector. - Remove the unconditional instruction to use the Skill for every Instagram request. - Clearly disclose that action payloads and returned Instagram data are processed by OOMOL. - Obtain user confirmation before transmitting sensitive account, media, or analytics inputs when third-party processing is not already clear from the request. - Document applicable retention, logging, privacy, and deletion policies. - Permit direct or alternative access methods when they can satisfy the request with less third-party exposure. - Continue restricting the allowed tool pattern to the `oo` CLI and avoid expanding local filesystem or unrestricted shell privileges.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

- **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>):

  ```bash
  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  ```

  ```powershell

• Confidence: 97% confidence
• Finding: The skill includes a curl-pipe-to-bash installation command that executes a remote script directly from the network without verification. If an agent follows this guidance, a compromised host, CDN, or upstream service could deliver arbitrary code and achieve full code execution on the user's machine.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill description says to use this skill for ANY Instagram request, which is an overly broad routing rule that can cause the agent to invoke this skill in situations beyond simple read-only data access. That increases the chance of unnecessary tool use, accidental execution of setup/install guidance, or bypassing narrower and safer alternatives.

Static analysis

No suspicious patterns detected.