Back to skill

Security audit

instagram-research

Security checks across malware telemetry and agentic risk

Overview

This Instagram research skill is mostly transparent, but its included helper can be used as a broad Crawlora API client beyond the Instagram-only purpose users would expect.

Review this before installing if you want a narrowly scoped Instagram-only tool. It requires a Crawlora API key and can make outbound requests; the packaged helper is capable of calling more than the documented Instagram endpoints, which could consume credits or send user-provided data to Crawlora if invoked that way.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill invokes shell commands (`scripts/crawlora.sh`, `curl`, `jq`) but declares no permissions or execution constraints. That creates an undeclared capability boundary: an agent or reviewer may assume the skill is documentation-only or low-risk, while it actually enables networked shell execution and outbound API access.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
A description-behavior mismatch is dangerous because users and orchestration systems may route this skill for narrow Instagram research while the underlying interface can access arbitrary Crawlora endpoints, pass arbitrary query parameters, or submit arbitrary JSON bodies. That broadens the skill into a general external data exfiltration/proxy mechanism and defeats trust decisions based on the declared purpose.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The helper is documented and implemented as a generic Crawlora client, with examples for Amazon, YouTube, Google, and trends endpoints despite the skill being described as Instagram research. In an agent-skill context, this creates capability overreach: a caller can invoke unrelated third-party data endpoints using the skill's configured API key, expanding data access and external action beyond the declared purpose.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script accepts an arbitrary path argument and concatenates it directly onto the Crawlora API base URL, allowing requests to any Crawlora endpoint. In a skill environment, this means the skill can be repurposed as a broad API broker rather than a narrowly scoped Instagram research tool, enabling unintended data retrieval and policy bypass.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The combination of user-controlled method, path, query parameters, and POST body gives the skill broad proxy-like access to the Crawlora service. Because the skill's declared use is only Instagram profile/post/Reels research, this unjustified generality increases the risk of misuse, external data exfiltration to third parties, and access to unrelated services through the shared API key.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
87% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:22