Instagram Scraper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:14 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Instagram public-profile scraper, but it includes guidance for bypassing service blocks and uses an unofficial internal endpoint.

Install only if you are comfortable scraping Instagram through an unofficial internal endpoint. Use conservative rate limits, respect applicable platform terms and legal obligations, avoid bypassing blocks or rejected requests, and handle saved JSON files as retained third-party data that may need deletion or access controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-15
Vulnerability Type: Unpinned dependency and supply-chain exposure
Risk Level: Medium

markdown

## Requirements

```bash
pip install httpx

text

### Technical Analysis

The installation command does not constrain `httpx` to a reviewed version and does not verify the downloaded artifact with a cryptographic hash. Its result therefore depends on the package versions and artifacts available through the Python package index configured on the user's system at installation time.

Although `httpx` is a legitimate package and there is no evidence that it is malicious, unconstrained dependency resolution prevents reproducible installation and could expose users to a future compromised release, malicious index substitution, or an incompatible version. Installing from a source distribution may also invoke package build logic on the local host.

### Attack Path

1. An attacker compromises a future dependency release, a configured package index, or the relevant distribution channel.
2. A user follows the documented `pip install httpx` command.
3. `pip` resolves the attacker-controlled or compromised artifact because no approved version or hash is specified.
4. The artifact is installed, and any applicable build-time code executes with the privileges of the user running `pip`.
5. Malicious package code may subsequently execute when the scraper imports or uses the dependency.

### Impact Assessment

Exploitation could run code with the privileges of the user performing the installation or running the scraper. The potential scope includes that user's files, environment variables, network access, and accessible application data. The documentation does not request elevated privileges, so administrative or root-level impact is not established unless the user independently runs the command with such privileges.

Remediation

View remediation

Remediation Suggestions

• Pin httpx and its transitive dependencies to reviewed versions in a lock file.
• Require cryptographic hashes, for example with pip install --require-hashes -r requirements.txt.
• Generate dependencies from a trusted source and review updates before changing the lock file.
• Recommend installation in a dedicated virtual environment running without administrative privileges.
• Add automated dependency vulnerability and integrity scanning to the release process.

other

Warning

• Location: SKILL.md:96

Finding

Guidance to Evade Service Anti-Abuse Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96-102
Vulnerability Type: Anti-abuse control evasion
Risk Level: Medium

markdown

## Error Handling

| Error | Cause | Fix |
|-------|-------|-----|
| `ValueError: User not found` | Username doesn't exist or is misspelled | Verify the handle |
| `PermissionError: Instagram blocked` | IP rate-limited or flagged | Use a VPN or residential proxy |
| HTTP 401 | Request rejected | Rotate User-Agent or wait before retrying |

Technical Analysis

The documentation recommends switching to a VPN or residential proxy after an IP block and rotating the User-Agent after an HTTP 401 rejection. These actions change the apparent network or client identity so collection can continue after the service has applied an access or anti-abuse control.

A VPN or residential proxy has legitimate uses, and changing a User-Agent is not inherently malicious. In this context, however, the recommendations are explicitly presented as responses to blocking and rejected requests. This creates a practical method for evading service-side enforcement rather than respecting the rejection and terminating or reducing collection.

Attack Path

1. The operator sends scraping requests to Instagram's internal API.
2. Instagram rate-limits, flags, blocks, or rejects the traffic.
3. The operator follows the documentation and routes requests through a VPN or residential proxy, changing the apparent source IP address.
4. The operator may also rotate the User-Agent to change the apparent client identity.
5. Requests resume under the altered identity, potentially continuing until that identity is also blocked.

Impact Assessment

This guidance may facilitate collection beyond limits imposed by the remote service and increase the volume or duration of scraping activity. Potential consequences include broader collection of public profile data, consumption of remote service resourc ...[truncated 397 chars]

Remediation

View remediation

Remediation Suggestions

• Remove recommendations to use residential proxies, VPNs, or User-Agent rotation in response to blocks or rejected requests.
• Treat HTTP 401 responses and explicit blocks as terminal failures unless access has been restored through an authorized process.
• Implement bounded exponential backoff with jitter for transient rate-limit responses.
• Enforce conservative per-host request limits and a maximum retry count.
• Honor applicable service terms, access policies, and documented rate limits.
• Prefer an authorized and documented API where one is available.
• Log rejection events without recording credentials or other sensitive information, and require operator review before resuming requests.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to scrape Instagram through an internal API endpoint but does not clearly warn that requests are sent to an external platform, may be monitored, and can trigger rate limits, IP blocking, or platform policy violations. In this context, omission of those warnings increases operational and compliance risk because users may unknowingly use a brittle, unofficial interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly states that scraped Instagram profile and post data is saved to a local JSON file, but it provides no warning about persistence, retention, access controls, or handling of collected third-party data. Even though the data is public, automatic storage can create privacy, compliance, and accidental disclosure risk if users do not realize the data is being retained on disk.

Content

No source excerpt is available for this finding.