Link Midjourney Instagram

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for Midjourney-to-Instagram automation, but it asks the agent to install and run unaudited repository code while handling Instagram credentials, browser sessions, API keys, and public posting authority.

Install only if you trust the surrounding repository, not just this skill file. Inspect `main.py`, `requirements.txt`, `.env.example`, and any imported modules before running it; use a virtual environment or container; avoid primary Instagram credentials; protect or delete `.env` and `browser_data/` when done; and require a manual review step before allowing the tool to publish posts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Execution of Unverified External Project Code and Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–15, 40–43, and 59–72
Vulnerability Type: Unverified dependency installation and execution outside the audited skill directory
Risk Level: Medium

Vulnerable Instructions

bash

pip install -r requirements.txt
python -m playwright install chromium
cp .env.example .env

bash

python main.py

The skill also supplies the following execution variants:

bash

python main.py --prompt "your midjourney prompt here"
python main.py --skip-instagram
python main.py --headless
python main.py --post-delay 60
python main.py --use-prompt-caption
python main.py --use-vision-caption

Technical Analysis

The skill directs the agent to leave the skill directory, locate a surrounding repository root containing main.py, install the packages specified by that repository's requirements.txt, and execute main.py. Neither requirements.txt nor main.py is included in the audited artifact, so their contents, integrity, dependency versions, package sources, and runtime behavior cannot be verified.

Installing Python packages can execute package installation or build hooks. Executing main.py directly grants that program the permissions of the user running the agent. Selecting the target repository by directory layout and the presence of a filename rather than by a fixed, validated path or cryptographic identity increases the risk of executing a replaced or unintended project.

This represents an insecure dependency and execution-boundary design. It is not evidence that the referenced project is malicious, but the instructions establish a path through which compromised dependencies or repository files could run arbitrary code.

Attack Path

1. An attacker modifies or supplies the surrounding repository, its requirements.txt, a referenced Python package, or main.py.
2. The agent follows SKILL.md, changes into the purported ...[truncated 1458 chars]

Remediation

View remediation

Remediation Suggestions

• Include all required executable code and dependency manifests inside a reviewed, versioned skill package.
• Use a fixed and validated project path instead of locating a repository by the presence of main.py.
• Pin every Python dependency to an exact version and use a lockfile containing cryptographic hashes.
• Install packages only from explicitly trusted package indexes and enable hash verification.
• Verify the expected hashes or signatures of main.py, dependency manifests, and related modules before execution.
• Run dependency installation and browser automation in an isolated virtual environment, container, or sandbox with least-privilege filesystem and network access.
• Prevent the installation process from accessing .env, browser profiles, and other credentials.
• Restrict permissions on .env and browser_data/ so unrelated processes cannot read them.
• Separate dependency installation from authenticated execution and require explicit user approval before posting content.
• Avoid passing secrets through command-line arguments, logs, or inherited environments unless strictly required.
• Document and enforce an allowlist of expected files, package names, versions, and execution entry points.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

pip install -r requirements.txt
python -m playwright install chromium
cp .env.example .env

編輯 .env 填入 IG 帳密；其餘選項見 .env.example 註解。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says to use the skill when working in this repository or when the user asks for Midjourney-to-Instagram automation, MJ→IG posting, or Playwright-based MJ/IG flows without official APIs. While partly domain-specific, the activation scope is still open-ended and lacks exclusion conditions or explicit boundaries, which could cause unintended invocation for adjacent Playwright or social-posting tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Most operational instructions and headings are presented in Traditional Chinese, and the file does not indicate that the user can choose another language. This can violate language/locale policy when a skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.