ClawHub
Back to skill

Security audit

Auto DM Instagram - InstantDM

Security checks across malware telemetry and agentic risk

Overview

This skill is a clearly disclosed Instagram account-management assistant that requires approval before sending real replies or DMs.

Install only if you intend to let the agent access a real Instagram creator or business account through InstantDM. Review drafts carefully before approving sends, because outbound actions reach real people and may spend InstantDM credits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description includes broad trigger phrases such as 'check Instagram engagement,' 'reply to followers,' and 'review comments,' which are common everyday requests. This can cause the skill to be invoked in situations the user did not specifically intend, increasing the chance of exposing real account data or initiating workflows tied to a live Instagram account.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.