AI Instagram Auto Poster

This package is mostly coherent with its stated purpose but there are a few things to check before using it: - Configuration mismatch: The registry metadata claims no required env vars, but the SKILL.md and scripts require IG_ACCESS_TOKEN, IG_BUSINESS_ACCOUNT_ID, CLOUDINARY_CLOUD_NAME, and CLOUDINARY_UPLOAD_PRESET. Make sure you set those environment variables before running. - Use least-privilege/test tokens: For Meta/Instagram, create and test with a Page access token tied to a test Page or app with the minimum required permissions (instagram_content_publish, pages_read_engagement). Do not use owner/root/long-lived tokens for initial testing. - Protect Cloudinary uploads: Prefer signed upload presets or restrict unsigned presets by folder/origin in your Cloudinary dashboard. Unsigned presets can allow public uploads and could expose your images or be abused. - Scraper safety: Only provide public, trusted URLs. The scraper enforces SSRF protections (DNS checks, redirect blocking, TLS verification) but it will extract publicly visible emails/phones from a page; do not supply URLs that expose PII you do not want handled. - Review and run locally first: Because the package is instruction-driven with bundled scripts, inspect the code (you have it) and run in an isolated environment before granting access in production. Confirm the scripts behave as you expect (e.g., the Instagram publish flow using your tokens). If these concerns are acceptable and you follow the hardening advice (signed Cloudinary preset, least-privilege test token, avoid private URLs), the skill appears to implement the functionality it advertises. If the registry metadata were corrected to list the required env vars, the coherence would improve.