Security audit
Security checks for vulnerabilities and agentic risk
Review recommended: this Instagram skill matches its purpose, but it can print access tokens and temporarily expose selected local media through a public tunnel.
Install only for a dedicated Meta app with minimal Instagram/Facebook permissions. Keep the .env file private and out of version control, avoid running refresh commands where stdout is logged, prefer hosted media URLs for sensitive files, and review each post or comment before allowing the command to run.
scripts/_common.js:157Refreshed Access Tokens Are Exposed in Process Output
scripts/_common.js:488Local Media Is Served Through an Unauthenticated Public Tunnel
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cp .env.example .env
Fill in your .env:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cp .env.example .env
Fill in your .env:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
FACEBOOK_APP_ID / FACEBOOK_APP_SECRET).GET https://graph.instagram.com/access_token
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
FACEBOOK_APP_ID / FACEBOOK_APP_SECRET).GET https://graph.instagram.com/access_token
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
FACEBOOK_APP_ID / FACEBOOK_APP_SECRET).GET https://graph.instagram.com/access_token
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
FACEBOOK_APP_ID / FACEBOOK_APP_SECRET).GET https://graph.instagram.com/access_token
The declared description says this skill is for Instagram account management tasks such as viewing profiles, listing posts, publishing media, and handling comments. The supplied code chunk does none of those things. It is a utility script specifically for refreshing a Facebook token using environment configuration and command-line arguments. That is a materially different primary purpose and involves authentication maintenance for Facebook resources, which is not disclosed in the description.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
name: instagram-api
description: Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests any Instagram-related task.
allowed-tools: Bash(node scripts/*)
compatibility: Requires node (v22+), npm, and cloudflared (for local file uploads). Requires env var INSTAGRAM_ACCESS_TOKEN in a .env file. Requires internet access to graph.instagram.com.
metadata:
version: "1.0"
---
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
name: instagram-api
description: Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests any Instagram-related task.
allowed-tools: Bash(node scripts/*)
compatibility: Requires node (v22+), npm, and cloudflared (for local file uploads). Requires env var INSTAGRAM_ACCESS_TOKEN in a .env file. Requires internet access to graph.instagram.com.
metadata:
version: "1.0"
---
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
name: instagram-api
description: Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests any Instagram-related task.
allowed-tools: Bash(node scripts/*)
compatibility: Requires node (v22+), npm, and cloudflared (for local file uploads). Requires env var INSTAGRAM_ACCESS_TOKEN in a .env file. Requires internet access to graph.instagram.com.
metadata:
version: "1.0"
---
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
name: instagram-api
description: Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests any Instagram-related task.
allowed-tools: Bash(node scripts/*)
compatibility: Requires node (v22+), npm, and cloudflared (for local file uploads). Requires env var INSTAGRAM_ACCESS_TOKEN in a .env file. Requires internet access to graph.instagram.com.
metadata:
version: "1.0"
---
The lockfile pins sharp to 0.34.5, and the static finding indicates known upstream advisories affecting bundled/native image parsing components such as libvips/libheif. In an Instagram-management skill, image and video publishing features make media handling core functionality, so vulnerable image-processing code is plausibly reachable with attacker-controlled media and could lead to crashes, denial of service, or potentially memory-corruption-based compromise depending on the affected codec path.
The package explicitly depends on sharp 0.34.5, and the static analysis reports known advisories affecting that version through bundled/native image libraries such as libvips and libheif. This is especially concerning in an Instagram skill because image and video processing commonly involves handling untrusted media, which can expose the service to crashes, denial of service, or potentially memory-corruption-style exploitation in native code.
The file performs extensive outbound network operations to Instagram/Facebook APIs and also creates an externally reachable tunnel via cloudflared. Undeclared network capability increases risk because the skill can transmit local data and credentials off-host in ways not obvious from its declared interface.
The file performs extensive outbound network operations to Instagram/Facebook APIs and also creates an externally reachable tunnel via cloudflared. Undeclared network capability increases risk because the skill can transmit local data and credentials off-host in ways not obvious from its declared interface.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function loadEnv(customPath) {
envPath = customPath
? path.resolve(customPath)
: path.join(__dirname, "..", ".env");
require("dotenv").config({ path: envPath, override: true });
}
This code writes refreshed access tokens back into the .env file in plaintext, increasing the chance of credential theft via local compromise, backups, logs, or accidental source control inclusion. Because these are account tokens for social platforms, exposure could enable unauthorized posting, reading comments, and account misuse.
// Update runtime
process.env.INSTAGRAM_ACCESS_TOKEN = newToken;
// Persist to .env file
let envContent = fs.readFileSync(envPath, "utf-8");
envContent = envContent.replace(
/INSTAGRAM_ACCESS_TOKEN=.*/,
For local uploads, the skill serves local files over HTTP and exposes them to the public internet through a cloudflared tunnel. That behavior is materially more dangerous than ordinary Instagram management because local user content becomes publicly retrievable from a transient external URL.
Spawning cloudflared introduces external executable execution and creates a public ingress path from the internet to a local HTTP server. In the context of an Instagram skill, this is non-obvious, expands attack surface, and can leak local media or fail open if the tunnel remains available longer than intended.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
To obtain these credentials:
1. Create a **Meta App** at [developers.facebook.com](https://developers.facebook.com/) and add the **Instagram** product.
2. In the App Dashboard, find your **App ID** and **App Secret** under App Settings > Basic (used as `FACEBOOK_APP_ID` / `FACEBOOK_APP_SECRET`).
3. Generate a **short-lived access token** via the Instagram Graph API Explorer or the Token Generator in the App Dashboard.
4. Exchange it for a **long-lived access token** (valid for 60 days, auto-refreshed by this skill):
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -L -o cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-$(dpkg --print-architecture).deb sudo dpkg -i cloudflared.deb
## Install as a Skill
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
curl -L -o cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-$(dpkg --print-architecture).deb sudo dpkg -i cloudflared.deb
## Install as a Skill
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- **Token storage**: Token refresh overwrites values in `.env` in plaintext. Never commit `.env` to version control.
- **Local file upload**: A temporary cloudflared tunnel exposes files during upload only. The tunnel shuts down immediately after. Only provide file paths you are comfortable briefly exposing.
- **Minimum permissions**: Create a dedicated Meta app and grant only: `instagram_business_basic`, `instagram_content_publish`, `instagram_manage_comments`, `pages_read_engagement`, `pages_show_list`.
## Requirements
The trigger text, 'Use when the user requests any Instagram-related task,' is broad enough to activate for vague or routine mentions of Instagram, increasing the chance the skill is invoked when not necessary. Over-broad triggering can cause unnecessary access to credentials, networked tools, or account-modifying actions in contexts where the user did not clearly intend that behavior.
The spec states that refreshed tokens are written back to the provided .env path, meaning credential files on disk are modified as a side effect of normal command execution. Without an explicit warning and safe-write guidance, this can surprise users, overwrite shared configuration, or leave sensitive tokens stored in insecure locations.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access