instagram-caption-scraper

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:41 AM UTC
• Version: 1.0.0

Overview

The skill mainly does what it says, but it also advises users to put Instagram login credentials into the script, which expands a public-post caption tool into authenticated access with plaintext password risk.

Review before installing. Use it only for public Instagram links, and do not put your Instagram username or password into the script. If authenticated access is ever needed, credentials should be handled through a protected secret or session mechanism with explicit consent and clear scope.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: instagram_scraper.py:45

Finding

Documentation Encourages Hardcoded Instagram Credentials

Content

View full analysis

Vulnerability Details

File Location: instagram_scraper.py:45-46; README.md:44
Vulnerability Type: Plaintext credential storage and unnecessary authenticated access
Risk Level: Medium

Vulnerable Code

instagram_scraper.py:45-46:

python

# Optional: uncomment and add credentials to access private accounts
# L.login("your_username", "your_password")

README.md:44:

markdown

- If you get 403 errors, add login credentials to the script (see scraper comments)

Technical Analysis

The documentation instructs users to insert an Instagram username and password directly into the source code. If followed, this stores reusable account credentials as plaintext in a file that may be copied, committed to source control, included in backups, shared for troubleshooting, or read by other users and processes with filesystem access.

Authenticated access also exceeds the Skill's declared minimum privilege. The Skill is documented as retrieving captions from public posts and reels, for which an Instagram password should not ordinarily be required. The suggested login path could extend the script from public-content retrieval to authenticated or private-content access.

The currently active implementation does not contain real credentials and does not invoke L.login; the risk arises from the explicit setup guidance and commented credential template.

Attack Path

1. Instagram returns a 403 or otherwise blocks an anonymous request.
2. The user follows the README and uncommented source-code example.
3. The user inserts a real Instagram username and password into instagram_scraper.py.
4. The modified file is committed, backed up, copied, shared, or accessed by another local user or process.
5. The exposed credentials are recovered and used to access the Instagram account.
6. Depending on the account's permissions, the exposed authenticated session may also permit access to content una ...[truncated 439 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to place usernames and passwords directly in source code.
• Preserve anonymous, public-only access as the default and documented operating mode.
• If authenticated access is intentionally supported, clearly document that it expands the Skill's permissions and data-access scope.
• Obtain explicit user consent before enabling authenticated retrieval.
• Load credentials from a dedicated secret manager or protected environment variables rather than source files.
• Prefer a protected Instaloader session file so the account password is not repeatedly handled by the script.
• Restrict any session file to the owning user, such as with filesystem mode 0600.
• Ensure source files, logs, exceptions, and command-line arguments never expose credentials or session tokens.
• Recommend a dedicated, least-privileged account if Instagram authentication is unavoidable.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Python Dependency Installation Lacks Artifact Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1; SKILL.md:64-67; README.md:20-23
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Low

Vulnerable Code

requirements.txt:1:

text

instaloader==4.14.1

SKILL.md:64-67:

bash

pip3 install instaloader==4.14.1

README.md:20-23:

bash

pip3 install instaloader==4.14.1

Technical Analysis

The dependency is consistently pinned to instaloader==4.14.1, which reduces unexpected version changes. However, neither the requirements file nor the documented installation commands provide cryptographic artifact hashes. Transitive dependencies are also not represented in a fully resolved, hash-locked dependency set.

Consequently, installation trusts the configured Python package index, its transport and account security, and the integrity of the selected release artifact. If an upstream release, package-index account, configured mirror, or resolved artifact were compromised, pip could install unverified code.

No evidence was found that instaloader is a typosquatted or intentionally malicious package. This finding concerns the absence of dependency integrity controls rather than confirmed malicious behavior in version 4.14.1.

Attack Path

1. An attacker compromises an upstream package release, package-index account, configured mirror, or dependency artifact.
2. A user runs the documented pip3 install instaloader==4.14.1 command or installs from requirements.txt.
3. Because no approved artifact hashes are enforced, pip accepts the artifact supplied by the configured index if it otherwise satisfies resolution requirements.
4. The compromised package is installed and may execute when imported or when installation/runtime hooks are reached.
5. Malicious dependency code runs with the privileges of the user or service operating the Skill.

Impact Assessment

A compromi ...[truncated 348 chars]

Remediation

View remediation

Remediation Suggestions

• Generate a reviewed, fully resolved dependency lock file containing cryptographic hashes for all required artifacts.

• Install dependencies with hash enforcement, for example:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Pin and hash transitive dependencies where applicable.

• Obtain artifacts only from an explicitly approved package index or internal mirror.

• Review dependency updates before regenerating the lock file.

• Run the Skill in a dedicated virtual environment under a non-privileged operating-system account.

• Add automated dependency and supply-chain scanning to release maintenance.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The core purpose mostly aligns: the code does retrieve data from public Instagram post or reel URLs and includes the caption. However, the declared description specifically says it 'returns the caption,' while the code returns more than just the caption by including post metadata such as owner handle, type, likes, and shortcode. That is an undeclared capability involving additional data extraction from Instagram. The CLI/stdin entrypoint is a minor extra behavior, but the main mismatch is the broader returned content versus the narrowly declared caption-only behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring for scrape_instagram_caption describes fetching the caption from an Instagram URL, which implies a caption-only result. The actual returned value includes several metadata fields in addition to the caption, creating a documentation-to-code mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code fetches post data from Instagram via Instaloader, which necessarily sends the user-supplied URL/shortcode request to an external service. Although the function docstring says it fetches a caption, there is no explicit warning, confirmation, or user-facing disclosure at the point of execution that a network request to Instagram will be made.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says the skill 'scrapes and returns the caption' from a public Instagram post or reel URL. However, the implementation also returns the owner username, post type, like count, and shortcode, expanding the behavior beyond caption extraction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.