ClawHub
Back to skill

Security audit

Auto DM Instagram - InstantDM

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Instagram management helper that discloses real-account actions and requires approval before sending messages or replies.

Install only if you intend to connect a real Instagram or Meta account through InstantDM. Review all drafted replies before approving them, keep batches small, and treat the full MCP URL containing auth=<key> like a password because logs, screenshots, or shared configuration could expose it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:12
Finding

API Credential Transmitted in a URL Query Parameter

Content
View full analysis
`. ``` ### Technical Analysis The connection procedure instructs users to place an InstantDM API key in the `auth` query parameter of an MCP endpoint URL. No real credential is hardcoded in the file, but the prescribed credential-handling pattern can expose the user's key. Although HTTPS encrypts the URL while it is in transit, complete URLs may still be retained or displayed by MCP client configuration, application and proxy logs, diagnostic reports, terminal history, screenshots, monitoring systems, or error messages. Query parameters are consequently unsuitable for long-lived bearer credentials unless every component handling the URL is explicitly designed to redact them. If the key functions as a bearer credential, possession may be sufficient to authenticate without additional proof of identity. ### Attack Path 1. A user obtains an InstantDM API key and substitutes it for the `` placeholder. 2. The resulting endpoint URL is entered into an MCP client or configuration interface. 3. The complete URL is retained or exposed through configuration output, logs, diagnostics, screenshots, command history, or telemetry. 4. An attacker with access to one of those sources extracts the `auth` query value. 5. The attacker connects to the InstantDM MCP endpoint using the disclosed key. 6. Subject to the permissions and restrictions assigned to that key, the attacker may read account data or invoke account-management operations. This path requires access ...[truncated 938 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description uses very broad trigger phrases like checking engagement, replying to followers, reviewing comments, sending DMs, and reporting performance. In a tool that can act on a real Instagram account and spend credits, overbroad invocation increases the chance the skill is selected in loosely related conversations and exposes users to unintended account actions or disclosure of account data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
## Ground rules

1. **Start every session with `whoami`** — confirms the connection, shows which Instagram account you're operating, the plan, and remaining credits. If it errors, walk the user through getting a key at app.instantdm.com/api-integration and connecting `https://openapi.instantdm.com/mcp?auth=<key>`.
2. **Never send without approval.** Before calling `reply_to_comment`, `send_dm`, `reply_to_ad_comment`, `reply_to_fb_comment`, or `trigger_flow`, show the user the exact text and the exact target (username/comment), and get explicit confirmation. For batches, present the full batch and state the total credit cost against the balance from `whoami`.
3. **Stop on 402 or 429.** 402 = credits exhausted → stop, link the user to app.instantdm.com to top up; never retry. 429 = hourly limit → stop the batch and report what was sent and what remains; never spin.
4. **Never mass-send identical text** to many users — it endangers the creator's Instagram account. Vary drafts, keep batches small.
5. **Ads tools** need the account connected via Facebook Login. On a `reconnect_required` error, tell the user to reconnect in InstantDM settings — don't retry.

Static analysis

No suspicious patterns detected.