Instagram Analyzer Wulongcha

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Instagram analytics purpose, but it needs review because it can drive a browser to arbitrary URLs and can write output paths derived from unsanitized usernames.

Review before installing or running. Use only public Instagram URLs you trust, avoid providing personal Instagram credentials, run it in an isolated environment, and restrict output to a dedicated directory. The publisher should add Instagram URL validation, username/path sanitization, clear credential handling guidance, and pinned dependencies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/instagram_analyzer.py:119

Finding

Unrestricted Browser Navigation Enables Server-Side Request Forgery

Content

View full analysis

dict: """Analyze a single Instagram post/Reel""" result = { "url": post_url, "post_type": "reel" if "/reel/" in post_url else "post", "username": "", "metrics": {}, "ratios": {}, "timing": {}, "error": None, "timestamp": datetime.utcnow().isoformat() } print(f"📊 Analyzing: {post_url}") with sync_playwright() as p: browser = p.chromium.launch(headless=self.config["scraper"]["headless"]) context = browser.new_context( user_agent=self.config["browser"]["user_agent"], viewport={"width": 390, "height": 844} ) page = context.new_page() try: page.goto(post_url, timeout=self.config["scraper"]["timeout"]) ``` ### Technical Analysis The `post` command accepts an arbitrary URL and passes it directly to Playwright's `page.goto()` without validating its scheme, hostname, port, resolved IP address, or redirect chain. Nothing enforces the documented restriction that the destination must be an Instagram post or Reel. Because Chromium makes the request from the host running the analyzer, a caller can direct it to services that are inaccessible from the caller's own network. Potential destinations include loopback interfaces, private network ranges, link-local addresses, and cloud instance metadata services. A public URL that redirects to an internal address can also bypass a hostname-only check unless each redirect is validated. The implementation subsequently calls `page.content()` and attempts to process the rendered document. Although the returned metrics expose only limited content, errors, timing, p ...[truncated 1656 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/instagram_analyzer.py:337

Finding

Profile Username Allows Output Path Traversal

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:2

Finding

Dependencies Are Not Pinned to Audited Versions

Content

View full analysis

=1.40.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 requests>=2.31.0 python-dateutil>=2.8.0 ``` ### Technical Analysis All dependencies use lower-bound-only version constraints. Each installation can therefore resolve to any newer version available from the configured package index, including releases that did not exist when the Skill was reviewed. This prevents reproducible builds and broadens the trusted supply-chain surface. A compromised future release, maliciously modified package-index response, or incompatible update could be installed without any project change. No hash verification or lock file is present to ensure that installed artifacts match reviewed distributions. The audit did not identify a known malicious package among the listed names. The finding concerns unsafe dependency resolution rather than evidence that these packages are currently malicious. The source also does not import `requests` or `python-dateutil`, so retaining them adds unnecessary installation exposure. ### Attack Path 1. An operator installs the dependencies using `requirements.txt`. 2. The package resolver selects the newest versions satisfying each lower bound. 3. A selected version may differ from the version previously tested or audited. 4. If a newly selected package or transitive dependency is compromised, its installation or imported runtime code executes in the analyzer environment. 5. That code receives the privileges of the installation or analyzer process. ### Impact Assessment The impact depends on the behavior of a compromised or vulnerable dependency and the privileges used during installation and execution. Potential consequences include: - Arbitrary code execution during installation or import. - Access to files and environment va ...[truncated 296 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says the skill should be used whenever a user wants to analyze Instagram data, check engagement rates, or extract Reels information, which is broad enough to match many ordinary social-media questions. Overbroad invocation can cause the system to route users into a browser-automation scraping workflow unexpectedly, increasing exposure to credential prompts, scraping behavior, and unnecessary data collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to configure Instagram credentials in a .env file to obtain certain metrics, but provides no warning about credential sensitivity, storage protections, least-privilege use, or risks of submitting credentials to automated scraping tools. In context, the skill also advertises stealth mode, human behavior simulation, and use of multiple accounts, which makes unsafe credential handling more dangerous because users may expose real accounts to compromise, policy violations, or unauthorized reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script saves analysis results derived from Instagram pages to JSON files on disk, but there is no confirmation prompt or explicit warning in the CLI description that collected data will be persisted locally. Because the tool processes third-party profile and post information and stores it automatically, users should be clearly informed before or when this happens.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower-bound constraint only, which allows future unreviewed versions to be installed and makes builds non-reproducible. This increases supply-chain risk and complicates verification that a known-safe version is used, though the requirement alone is not direct exploit code.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

# Instagram Analyzer Dependencies
playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is unpinned and may resolve to different versions over time, including versions with regressions or newly introduced security issues. This is a supply-chain hardening weakness because it prevents reproducible installs and clear attestation of what code is actually deployed.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# Instagram Analyzer Dependencies
playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The unpinned lxml dependency is more concerning because lxml has a history of security advisories, and the manifest does not prove that only a patched version will be installed. In a scraper/parser context, XML/HTML parsing libraries may process attacker-influenced content, so version ambiguity increases risk.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Instagram Analyzer Dependencies
playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The manifest does not pin lxml, and lxml has multiple historical advisories, so it is impossible to verify from this file whether deployments will receive a patched or vulnerable release. Given this skill appears to analyze web content and includes HTML/XML parsing dependencies, an affected parser version could become reachable through untrusted input.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Requests is unpinned, so installations may pick different versions across environments, including versions affected by known issues. Because HTTP client libraries handle outbound connections, redirects, proxies, auth, and credential material, unresolved version drift can have real security consequences in deployed agents.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

playwright>=1.40.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Because requests is not pinned, the file cannot demonstrate that only non-vulnerable releases are installed, despite the package having multiple known advisories. In an agent that likely performs network requests, this uncertainty is more meaningful because HTTP client flaws can affect credential handling, redirect behavior, or trust decisions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Using only a minimum version for python-dateutil creates non-reproducible dependency resolution and weakens supply-chain assurance. While not necessarily immediately exploitable on its own, it still leaves the environment open to unreviewed future changes.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

beautifulsoup4>=4.12.0
lxml>=4.9.0
requests>=2.31.0
python-dateutil>=2.8.0

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code writes a separate file containing collected Reel URLs, but the skill does not disclose this extra output behavior in its command help or a broader warning message. Separate storage of harvested links is a data-handling behavior that should be made clear to the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.