Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Instagram Publisher

v1.0.1

Publish posts to Instagram. Use when the user says 'post to Instagram', 'publish on IG', 'schedule Instagram post', 'create Instagram carousel', 'post a Reel...

0· 107·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for snoopyrain/instagram-publisher.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Instagram Publisher" (snoopyrain/instagram-publisher) from ClawHub.
Skill page: https://clawhub.ai/snoopyrain/instagram-publisher
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Config paths to check: MCP Connector link from boring.aiagent-me.com (contains embedded auth token)
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install instagram-publisher

ClawHub CLI

Package manager switcher

npx clawhub@latest install instagram-publisher
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (publish to Instagram) match the declared requirement (an MCP Connector link to Boring) and the SKILL.md describes only publishing-related actions (list accounts, upload media, publish/schedule/cancel posts). The required config (MCP link containing an auth token) is consistent with a 3rd-party publishing integration.
Instruction Scope
SKILL.md only instructs connector actions (boring_list_accounts, boring_upload_file, boring_publish_post, etc.), requires media URLs or an upload step, and does not instruct the agent to read unrelated system files or environment variables. It does route media and publish operations through Boring's servers (re-hosting/upload), which is expected for this integration.
Install Mechanism
Instruction-only skill with no install spec and no code files—lowest-risk install surface. There is no download or package installation performed by the skill.
Credentials
The only required credential is the MCP Connector link (an embedded auth token). That is proportionate for a publisher skill, but the token appears to be long-lived (60 days) and grants publish permissions — a sensitive capability. No unrelated environment variables or secrets are requested.
Persistence & Privilege
Skill is not always-included and has no install-time persistence. It can be invoked autonomously (platform default), which combined with a publish-capable token means an agent could post if configured to do so; autonomous invocation itself is normal but worth awareness.
Assessment
This skill appears internally consistent, but take these precautions before installing: treat the MCP Connector link like a password and do not paste it in public chat; verify the Boring service (https://boring.aiagent-me.com) and the GitHub source if you need supply-chain confidence; prefer testing with a non-critical Instagram Business account first; understand the link grants publish rights (can create/schedule posts) and is long‑lived — revoke/regenerate it if you suspect compromise; and be aware that an autonomously-invoking agent combined with this token could publish without extra confirmation, so only enable autonomous actions if you trust the agent's rules.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📸 Clawdis
ConfigMCP Connector link from boring.aiagent-me.com (contains embedded auth token)
latestvk976s9nn6pggsre1zzbagyapj983q75y
107downloads
0stars
2versions
Updated 1mo ago
v1.0.1
MIT-0

Boring Instagram Publisher

Publish photos, carousels, and Reels to Instagram. Powered by Boring.

Security & Data Handling

  • MCP link is a credential: Your MCP Server URL (https://boring.aiagent-me.com/mcp/t/xxxxx...) contains an embedded authentication token. Treat it like a password — do not share it publicly.
  • Token scope: The embedded token grants publish access to your connected social media accounts. It can create posts, upload media, and manage scheduled posts on the platforms you have connected. It cannot access your social media passwords or modify account settings.
  • Token storage: The token is stored server-side in Boring's database (MongoDB on DigitalOcean). It is never written to your local filesystem. You can regenerate or revoke it anytime at boring.aiagent-me.com/settings.
  • Data flow: Analytics queries are sent from Boring's server (Google Cloud, us-central1) to the platform's API on your behalf. Only performance metrics are retrieved — no content is uploaded or modified.
  • No local credentials: No local API keys, environment variables, or secrets are needed. All auth is embedded in the MCP link.
  • Third-party service: This skill relies on Boring, an open-source social media management tool. Source code: github.com/snoopyrain.

Prerequisites

  1. Sign up at boring.aiagent-me.com with Google
  2. Connect Instagram — requires an Instagram Business or Creator account (personal accounts not supported)
  3. Get your MCP link: Go to Settings → copy your MCP Server URL (contains your auth token — treat it like a password)
  4. Add to Claude: Paste the MCP link as a Connector — no install, no API key needed

Workflow

Step 1: List Accounts

Call boring_list_accounts and filter for instagram platform.

Step 2: Confirm Content

IMPORTANT: Instagram requires media. Text-only posts are NOT supported.

TypeMediaSpecs
Photo1 imageJPG/PNG, 320x320 to 1440x1440
Carousel2-10 imagesAll images must have matching aspect ratios
Reels1 videoMP4, 9:16 vertical, up to 90 seconds
  • Caption: Up to 2,200 characters
  • If the user only provides text with no media, inform them that Instagram requires at least one image or video

Step 3: Prepare Media

Media must be publicly accessible URLs:

  • Local files: boring_upload_file with file_path → returns public URL
  • External URLs: boring_upload_from_url → re-hosts to Boring cloud storage
  • Google Drive links: Pass directly to media_urls

Step 4: Publish or Schedule

Call boring_publish_post:

boring_publish_post(
  account_id="<instagram_account_id>",
  platform="instagram",
  text="Your caption here #hashtags",
  media_urls=["https://...image.jpg"]
)

For carousel (2-10 images):

boring_publish_post(
  account_id="<instagram_account_id>",
  platform="instagram",
  text="Swipe to see more!",
  media_urls=["https://...1.jpg", "https://...2.jpg", "https://...3.jpg"]
)

For Reels (video):

boring_publish_post(
  account_id="<instagram_account_id>",
  platform="instagram",
  text="Check out this Reel!",
  media_urls=["https://...video.mp4"]
)

Schedule: Add scheduled_at in ISO 8601 format:

boring_publish_post(..., scheduled_at="2025-12-25T10:00:00Z")

Step 5: Report

Show the post ID and confirmation. If scheduled, show the scheduled time.

Managing Scheduled Posts

  • View: boring_list_scheduled_posts with platform: "instagram"
  • Cancel: boring_cancel_scheduled_post with scheduled_post_id

Instagram-Specific Notes

  • Media is mandatory — always need at least 1 image or video
  • Carousel aspect ratios: All images in a carousel must have the same aspect ratio
  • Reels: Vertical video (9:16), up to 90 seconds
  • Token: 60-day long-lived token with auto-refresh
  • Rate Limit: 200 calls/hour per user, 4,800/hour per app
  • Permissions: instagram_business_content_publish, instagram_business_basic

Error Handling

ErrorSolution
MediaRequiredInstagram requires media — ask user for an image or video
InvalidCarouselSizeCarousel needs 2-10 images
CarouselCreationFailedCheck that all images have the same aspect ratio
MediaTooLargeImages max 8MB
TokenExpiredReconnect at boring.aiagent-me.com

Documentation

Full API docs: boring-doc.aiagent-me.com

Comments

Loading comments...