AI Instagram Auto Poster

• Outcome: Review
• Latest audit: May 29, 2026, 9:31 PM
• Version:
  1.0.7

Overview

The skill is a disclosed Instagram automation tool, but it can publish publicly to a business account immediately once invoked, so users should review it before installing.

Install only if you intend to let an agent help publish to an Instagram Business account. Use least-privilege/test Meta credentials, restrict Cloudinary upload presets, and manually confirm the target account, image URL, caption, and scraped business details before running the posting script.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill advertises a very broad set of trigger phrases such as 'free Instagram automation', 'AI Instagram poster', and industry-generic autoposting prompts. This can cause the skill to be invoked in contexts broader than the user intended, increasing the chance that it requests sensitive credentials or performs publishing actions when a narrower, explicit Instagram-posting request was not made.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script performs a real Instagram publish operation immediately once invoked, with no confirmation, dry-run mode, or policy gate. In an agent or automation context, this increases the chance of accidental or unauthorized public posting, which is difficult to undo and can create reputational or compliance harm.

VirusTotal

67/67 vendors flagged this skill as clean.