T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:40- Finding
Mandatory Promotional Content Injection into Published Posts
- Content
View full analysis
- Remediation
View remediation
Security audit
Itinerary Carousel Post
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it advertises, but it gives an agent broad authority to publish to Instagram, use local account credentials, and modify a GitHub repository without clear approval gates or tight scoping.
Install only if you are comfortable letting this skill use Instagram publishing credentials, make temporary images publicly accessible, and modify/push to a GitHub repository. Before use, require a full preview of images, caption, branding, target account, public URLs, and exact git changes, then confirm publication explicitly.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:40- Finding
Shell Command Injection Through Unescaped Itinerary Fields
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:66- Finding
Instagram Access Token Exposed Through Process Arguments and Request URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes making images publicly accessible via GitHub and then publishing them to Instagram, but it does not require explicit user warning or consent about external data exposure and irreversible posting. In context, this is especially dangerous because the workflow both uploads content to a public location and posts to a social media account using stored credentials.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Using
git rm img/instagram/slide-*.jpgintroduces file-deletion behavior based on a glob in a repository context, which can remove multiple tracked files and be dangerous if the working directory or file set is not exactly as expected. In this skill, the danger is amplified because the deletion is followed by commit and push, making mistakes externally persistent.- Content
- Cleanup hosted images — after publish is confirmed, delete the images from the tabiji repo and push:
bash cd /path/to/tabiji/repo git rm img/instagram/slide-*.jpg git commit -m "cleanup: remove instagram carousel images after publish" git push
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text Also clean up local temp files: ```bash rm -rf /tmp/ig-carousel/Output: Instagram post URL
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text Also clean up local temp files: ```bash rm -rf /tmp/ig-carousel/Output: Instagram post URL
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The invocation description is broad enough to match generic requests for Instagram posts or social content, which can cause the skill to trigger in contexts where the user did not intend automated publishing or credential use. Because this skill performs external posting and repo/network actions, over-broad activation materially raises the risk of unintended execution.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The skill transmits data to external services by searching Instagram and downloading third-party media, which is expected for the feature but still represents a real external data flow. In this context the risk is increased by automated scraping/downloading from external sources and subsequent reuse in published content, which may create privacy, copyright, or policy issues.
- Content
md For each subject: 1. `web_search`: `site:instagram.com/p/ "{subject}" photo` (10 results) 2. Download top 5 candidates: `curl -s -L -o /tmp/ig-carousel/raw-{slug}-{n}.jpg "https://www.instagram.com/p/{shortcode}/media/?size=l"` 3. Vision-score each with: "Rate 1-10 as hero destination photo for {subject}. Description + score only." 4. Keep best per subject → `/tmp/ig-carousel/{slug}-best.jpg`
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill uses a local git repository and GitHub raw URLs as an ad hoc public image-hosting channel, causing generated images to be copied into a repo and pushed externally. This creates unnecessary data exposure and grants repository modification capability unrelated to the core task of generating a carousel, increasing risk of unintended content publication or repository tampering.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The cleanup workflow performs repository deletion operations and pushes commits, giving the skill ongoing write access to a local repo beyond the minimum needed to publish a post. If mis-targeted or manipulated, this could remove unintended files or alter repository history/content under the user's identity.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly instructs retrieval of Instagram API credentials from the macOS Keychain, which expands its capability from content generation into secret access and account control. While publishing to Instagram does require credentials, embedding secret-retrieval instructions in the skill increases the chance of unauthorized credential use or unintended privilege access if invoked broadly or by an untrusted workflow.
- Content
Static analysis
No suspicious patterns detected.