Instagram Analyzer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:36 PM UTC
• Version: 1.0.0

Overview

The skill is mostly an Instagram analytics scraper, but it leaves user-controlled URLs and usernames too broad, creating review-worthy network and file-writing risks.

Review this skill before installing. Use it only with trusted Instagram usernames and Instagram post/Reel URLs, avoid supplying arbitrary URLs, keep outputs in a controlled directory, and do not store real Instagram credentials in shared folders or source control. A safer version should validate Instagram hosts and username syntax, constrain output paths, document privacy/retention expectations, and pin dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/instagram_analyzer.py:128

Finding

Unrestricted Browser Navigation Enables Server-Side Request Forgery

Content

View full analysis

dict: """Analyze a single Instagram post/Reel""" result = { "url": post_url, "post_type": "reel" if "/reel/" in post_url else "post", "username": "", "metrics": {}, "ratios": {}, "timing": {}, "error": None, "timestamp": datetime.utcnow().isoformat() } print(f"📊 Analyzing: {post_url}") with sync_playwright() as p: browser = p.chromium.launch(headless=self.config["scraper"]["headless"]) context = browser.new_context( user_agent=self.config["browser"]["user_agent"], viewport={"width": 390, "height": 844} ) page = context.new_page() try: page.goto(post_url, timeout=self.config["scraper"]["timeout"]) ``` ### Technical Analysis The `post_url` argument is controlled by the caller and is passed directly to Playwright's `page.goto()` method. The implementation does not validate the URL scheme, hostname, port, resolved IP address, or redirect destination. Although the command is documented as accepting Instagram post URLs, no code enforces that restriction. A caller can therefore direct Chromium to HTTP services available from the Skill's execution environment, including localhost, private network addresses, link-local services, or arbitrary external websites. Using a browser rather than a basic HTTP client does not prevent SSRF. Chromium still issues requests with the network access available to the host process and may follow redirects to otherwise prohibited destinations. ### Attack Path 1. An attacker invokes `analyze-post` with a URL that targets an internal service rather than Instagram. 2. ` ...[truncated 878 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/instagram_analyzer.py:352

Finding

Profile Username Allows Output Path Traversal and Unauthorized File Creation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Mutable and Unverified Dependency Resolution Creates Supply-Chain Risk

Content

View full analysis

=1.40.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0 python-dateutil>=2.8.0 ``` ### Technical Analysis The Skill's dependency metadata requests installation of mutable package names without exact versions. The requirements file also allows any future release above the specified minimum versions. Neither source provides cryptographic hashes for integrity verification. Consequently, the code installed in a future deployment can differ from the dependency versions reviewed during this audit. Package installation and import may execute third-party build or initialization code with the privileges of the Skill environment. The dependency declarations are also inconsistent: `requests` and `python-dateutil` are present in `requirements.txt` but are not used by the reviewed implementation, unnecessarily expanding the supply-chain attack surface. This finding does not establish that the named packages are currently malicious. It identifies non-reproducible and unverified dependency resolution that could expose deployments to a compromised, malicious, or incompatible future release. ### Attack Path 1. The Skill is installed or rebuilt after dependency versions have changed. 2. The package resolver selects the latest versions satisfying the unbounded declarations. 3. Package installation processes or imports execute code that was not part of the originally reviewed dependency set. 4. If an upstream release or distribution channel is compromised, attacker-controlled package code executes with the inst ...[truncated 508 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly stores scraped profile data, post analytics, and reels links to local files, but provides no guidance on privacy, retention, access control, or lawful handling of potentially personal data. This creates a real security and privacy risk because users may collect and persist identifiable third-party data without understanding storage exposure or compliance obligations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to configure Instagram credentials in a .env file but does not include any warning about secret management, accidental disclosure, or safe storage practices. This is dangerous because users may place live account credentials in insecure locations, commit them to source control, or expose them through logs and shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code navigates to user-supplied Instagram URLs using Playwright, which causes network requests to an external service and transmits request metadata such as IP address, headers, and the requested target. Although there is a progress print for the URL being analyzed, there is no user-facing warning or disclosure that the tool performs live external scraping/network access.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of any newer version, making builds non-reproducible and increasing supply-chain risk if a later release introduces a vulnerability or breaking change. In a security-sensitive automation skill, this weakens assurance that the tested dependency set is the one actually deployed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

# Instagram Analyzer Dependencies
playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of any newer version, making builds non-reproducible and increasing supply-chain risk if a later release introduces a vulnerability or breaking change. In a security-sensitive automation skill, this weakens assurance that the tested dependency set is the one actually deployed.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# Instagram Analyzer Dependencies
playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of any newer version, making builds non-reproducible and increasing supply-chain risk if a later release introduces a vulnerability or breaking change. This is more concerning for lxml because it has a history of security advisories, so an unpinned install makes it unclear whether a safe version is consistently used.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Instagram Analyzer Dependencies
playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The manifest does not pin lxml, and lxml has multiple historical advisories, so it is impossible to verify from this file whether deployments will use an affected or remediated version. In a parser/library used to process external content, version uncertainty increases the chance that a vulnerable release could be installed unnoticed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of any newer version, making builds non-reproducible and increasing supply-chain risk if a later release introduces a vulnerability or breaking change. This is somewhat more significant for requests because it is commonly used for network communication and has had multiple advisories, so version ambiguity reduces confidence in transport-layer safety.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest does not pin requests, and requests has several known advisories, so the actual installed version cannot be assessed for exposure from this file alone. Because requests handles outbound HTTP and may process redirects, auth, and URL parsing, unresolved version selection can leave the skill exposed to known client-side issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of any newer version, making builds non-reproducible and increasing supply-chain risk if a later release introduces a vulnerability or breaking change. Even without known context-specific abuse here, exact version control is a standard hardening measure for reliable and secure builds.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Static analysis

No suspicious patterns detected.