Generate Instagram marketing content from product URLs. Extract product information and create engaging Instagram posts with image suggestions, captions, and hashtags optimized for engagement. Use when user provides a product URL from e-commerce sites like Amazon, Shopify, Taobao, etc. and wants Instagram marketing content such as Image/text post ideas, engaging captions with CTAs, hashtag strategy, or Story/reels content suggestions.

v1.0.0

Generate Instagram marketing content from product URLs. Extract product information and create engaging Instagram posts with image suggestions, captions, and hashtags optimized for engagement. Use when user provides a product URL from e-commerce sites like Amazon, Shopify, Taobao, etc. and wants Instagram marketing content such as Image/text post ideas, engaging captions with CTAs, hashtag strategy, or Story/reels content suggestions.

10· 3.9k·7 current·7 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description, SKILL.md, templates, and the included extract_product.py all align: the skill needs to fetch product pages and produce Instagram content. No unrelated credentials, binaries, or config paths are requested.
!
Instruction Scope
Runtime instructions tell the agent to run scripts/extract_product.py which performs HTTP requests to the user-provided URL and downloads page content/images. This is expected for the purpose, but it means the skill will fetch arbitrary external URLs (including images) and parse their HTML. The instructions do not constrain allowed domains or validate input, creating risk of server-side request forgery (SSRF) or unintended access to internal network endpoints (e.g., cloud metadata services) if the agent runs in a networked environment.
Install Mechanism
No install spec — instruction-only with a Python script included. No remote downloads or package installs are requested by the registry metadata. The only runtime dependency is the Python packages 'requests' and 'bs4' (BeautifulSoup), which the script checks for and falls back to a manual prompt if absent.
Credentials
The skill requests no environment variables, credentials, or config paths. That is proportionate given its functionality. Note: network access (outbound HTTP) is implicitly required but not declared as an environment requirement.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request persistent/system-wide privileges nor modify other skills. Autonomous invocation is allowed by default but not an additional privilege here.
Assessment
This skill appears to do what it says — it fetches product pages and builds Instagram-ready content — but it will perform HTTP requests to any URL a user supplies. Before installing or running: - Understand the network risk: if the agent runs in an environment with access to internal services or cloud metadata (e.g., 169.254.169.254), a malicious or mistaken URL could expose sensitive data (SSRF). Never pass internal or sensitive URLs to the skill. - Run the skill in a restricted/sandboxed environment where outbound requests are limited or monitored (or enforce an allowlist of e‑commerce domains). - Review and, if needed, harden scripts: add domain allowlists, timeout limits, and response-size limits; validate/sanitize input URLs; and avoid automatic retrieval of arbitrary resources. - Be aware of legal/TOS issues: scraping some e-commerce sites may violate terms of service; check site policies. - Ensure dependencies (requests, bs4) are installed from trusted sources and that the runtime has appropriate rate limits to avoid accidental abuse. If you want, I can suggest concrete hardening changes to scripts/extract_product.py (e.g., allowlist logic, metadata IP block, stricter timeouts, and size bounds) or produce a short checklist to safely run this skill in production.

Like a lobster shell, security has layers — review code before you run it.

latestvk9743av60rnfae8tzfjs3kz9gh80ddfy

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments