Instagram Content Studio

Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests an...

Security Scan

The skill's code and instructions reasonably implement Instagram Graph API functionality, but there are coherence issues (registry metadata omits required credentials/install steps) and sensitive behaviors (writing tokens to .env, starting cloudflared tunnels to expose local files) that the user should understand before installing.

Purpose & Capability

The scripts and SKILL.md clearly require an INSTAGRAM_ACCESS_TOKEN (and optionally FACEBOOK_USER_ACCESS_TOKEN, FACEBOOK_APP_ID/SECRET) and Node + cloudflared, which are appropriate for an Instagram management tool — but the registry metadata claims no required env vars/config paths. That metadata mismatch is an incoherence that could mislead users about what secrets and tooling this skill needs.

Instruction Scope

Runtime instructions and scripts instruct the agent to load and overwrite a local .env file, refresh and persist tokens, read local media files, and start a cloudflared tunnel that briefly exposes local files to the public internet. Those behaviors are within the stated goal (publishing local media) but elevate risk: token persistence and temporary public exposure of arbitrary local paths are sensitive operations and should be explicitly authorized by the user each time.

Install Mechanism

There is no install spec in the registry (instruction-only), but the package includes Node scripts and package.json/package-lock.json; README instructs running npm install. Dependencies (dotenv, sharp) are reasonable for image/video handling. The missing install metadata is an inconsistency but not inherently malicious.

Credentials

The env vars required by the code (INSTAGRAM_ACCESS_TOKEN, and optionally FACEBOOK_USER_ACCESS_TOKEN, FACEBOOK_APP_ID, FACEBOOK_APP_SECRET) are appropriate for Graph API operations. However the registry metadata omitted these requirements. The code persists refreshed tokens and Facebook user tokens back into the .env file in plaintext, and requires the app secret to perform FB token refresh — both are sensitive and warrant caution.

Persistence & Privilege

always:false and the skill confines changes to its own .env file; it does not request system-wide modifications. Still, the skill can be invoked autonomously (platform default) and when invoked it can read local files and start a cloudflared tunnel to publish them; combined, that increases potential impact if an agent acts without explicit confirmation.

What to consider before installing

What to check before installing: - Metadata mismatch: the registry entry claims no required env vars, but the skill requires INSTAGRAM_ACCESS_TOKEN and optionally FACEBOOK_USER_ACCESS_TOKEN / FACEBOOK_APP_ID / FACEBOOK_APP_SECRET. Treat the SKILL.md and scripts as authoritative. - Tokens: the scripts automatically refresh and overwrite values in a local .env file in plaintext. Do not keep secrets in a repository; use a dedicated .env and restrict filesystem access. Review _common.js (refreshIgToken/refreshFbToken) if you need to be certain how tokens are updated. - Local-file uploads: posting local images/videos starts a cloudflared Quick Tunnel that briefly exposes the given files to the public internet. Only provide files you are comfortable exposing and verify cloudflared is installed from an official source. - Autonomous invocation: platform default allows the agent to call the skill without an explicit user action. If you want manual approval before any publish or file-exposing action, disable autonomous invocation or require the agent to ask for confirmation. The SKILL.md's guidance to confirm captions/comments is not an enforced safeguard. - Review code and run in isolation: if you plan to use this, audit the provided scripts (especially _common.js and tunnel logic), run npm install in a sandbox or container, and consider limiting permissions by creating a dedicated Meta app with only the listed minimal permissions. - If unsure: do not supply production credentials. Test with a throwaway Instagram account and app first.

Instagram API Skill

A skill for managing an Instagram account via the Instagram Graph API. Supports profile viewing, post management, image publishing, video/Reels publishing, and comment operations.

Prerequisites

• A .env file with credentials must be configured.
  • Required: INSTAGRAM_ACCESS_TOKEN
  • Recommended (for comment/reply via Facebook Graph): FACEBOOK_USER_ACCESS_TOKEN
  • Required for FB token refresh: FACEBOOK_APP_ID, FACEBOOK_APP_SECRET
• cloudflared must be installed for local image/video posting.
• If the user specifies a .env file path, append --env <path> to every command.
  • Example: node scripts/get-profile.js --env /home/user/.instagram-env
• All scripts must be run with this project root as the working directory.

Available Commands

All commands automatically refresh the token before execution. No manual refresh needed.

Refresh Token

# Instagram token refresh
node scripts/refresh-token.js

# Facebook user token refresh (for comments/replies flow)
node scripts/refresh-facebook-token.js

Manually refreshes token(s) and returns expiration info.

View Profile

node scripts/get-profile.js

Returns profile info (name, username, account type, media count).

List Posts

node scripts/get-posts.js [--limit 10]

Returns the user's post list. Use --limit to set the count (default: 10).

View Post Detail

node scripts/get-post.js <media-id>

Returns post detail including like count and comment count.

Publish Image

# Single image (URL)
node scripts/post-image.js --caption "Caption" https://example.com/photo.jpg

# Single image (local file)
node scripts/post-image.js --caption "Caption" ./photos/image.png

# Carousel — multiple images (URL)
node scripts/post-image.js --caption "Caption" https://example.com/a.jpg https://example.com/b.jpg

# Carousel — multiple images (local files)
node scripts/post-image.js --caption "Caption" ./img1.png ./img2.png ./img3.jpg

• 1 image → single post, 2+ images → automatically posted as carousel (max 10).
• Both URLs (http://, https://) and local file paths are supported, but mixing is not allowed.
• Supported local file formats: jpg, jpeg, png, gif, webp, heic/heif (HEIC is automatically converted to JPEG).

Publish Video (Reels)

# Single video (URL)
node scripts/post-video.js --caption "Caption" https://example.com/video.mp4

# Single video (local file)
node scripts/post-video.js --caption "Caption" ./videos/clip.mp4

# With cover image and options
node scripts/post-video.js --caption "Caption" --cover https://example.com/cover.jpg --thumb-offset 5000 --share-to-feed true https://example.com/video.mp4

# Video carousel — multiple videos (URL)
node scripts/post-video.js --caption "Caption" https://example.com/a.mp4 https://example.com/b.mp4

# Video carousel — multiple videos (local files)
node scripts/post-video.js --caption "Caption" ./clip1.mp4 ./clip2.mov

• 1 video → Reels post, 2+ videos → automatically posted as carousel (max 10).
• Both URLs and local file paths are supported, but mixing is not allowed.
• Supported formats: mp4, mov (max 100MB per file).
• --cover, --thumb-offset, --share-to-feed options are only available for single video posts (not carousels).
• Video processing takes longer than images; the script waits up to 10 minutes.

View Comments

node scripts/get-comments.js <media-id>

Returns comments and replies for a specific post.

Post Comment

node scripts/post-comment.js <media-id> --text "Comment text"

Reply to Comment

node scripts/reply-comment.js <comment-id> --text "Reply text"

Workflow Guidelines

• When publishing images or videos, always confirm the caption with the user before executing.
• After publishing, report the result ID and permalink to the user (both are included in the output).
• Video processing takes longer than images. Inform the user that it may take a few minutes.
• When writing comments/replies, confirm the content with the user before executing.
• All command outputs are in JSON format.

Error Handling

If the output contains an error field, an error has occurred. Explain the cause to the user and suggest a resolution.

{ "error": "error message" }

Security

Token storage

• refreshIgToken() and refreshFbToken() overwrite tokens in the .env file in plaintext. Do not commit .env to version control.
• Create a dedicated Meta app with minimum required permissions (see below).

Local file upload

• Local image/video posting starts a temporary cloudflared Quick Tunnel to expose files so Instagram servers can download them.
• The tunnel is active only during the upload and is shut down immediately after.
• Only provide file paths you are comfortable briefly exposing to the internet.

Minimum required permissions

When creating your Meta app, grant only these permissions:

• instagram_business_basic — profile and media read
• instagram_content_publish — image/video publishing
• instagram_manage_comments — comment read/write
• pages_read_engagement — required for comment API via Facebook Graph
• pages_show_list — required for page-linked Instagram accounts