ClawHub
Back to skill

Security audit

golden-rule

Security checks for vulnerabilities and agentic risk

Overview

This Instagram automation is mostly disclosed, but it needs Review because it can post public replies and DMs from an account, uses a long-lived token, and runs an extra OpenClaw CLI notification.

Review this carefully before installing. Only use it if you intentionally want an agent to send Instagram DMs and public replies automatically from your business account. Use a least-privileged token, keep it out of source control, rotate it if exposed, and consider removing or disabling the OpenClaw webchat notification and replacing token query/payload use with safer authorization-header handling where supported.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/ig_golden_hour.py:1
Finding

Unpinned Runtime Dependency Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ig_golden_hour.py:25
Finding

Instagram Access Token Exposed Through Request Parameters and Payloads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (16)

Tainted flow: 'params' from os.environ.get (line 28, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ig_golden_hour.py (reported line 32)May include surrounding context.

python
'access_token': token,
                'fields': 'id,text,from'
            }
            response = requests.get(url, params=params)
            comments = response.json().get('data', [])
            
            for comment in comments:

Tainted flow: 'payload' from os.environ.get (line 44, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ig_golden_hour.py (reported line 45)May include surrounding context.

python
# 1. Send the Private DM Reply
                    print(f"📨 Sliding into DMs: {dm_text}")
                    payload = { "recipient": { "comment_id": c_id }, "message": { "text": dm_text }, "access_token": token }
                    requests.post(f"https://graph.facebook.com/v19.0/me/messages", json=payload)
                    
                    # 2. Reply publicly to double the engagement
                    print(f"💬 Replying publicly to the comment ID: {c_id}")

Tainted flow: 'payload_reply' from os.environ.get (line 49, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ig_golden_hour.py (reported line 50)May include surrounding context.

python
# 2. Reply publicly to double the engagement
                    print(f"💬 Replying publicly to the comment ID: {c_id}")
                    payload_reply = { "message": "Just sent you a DM with the link! 🚀", "access_token": token }
                    requests.post(f"https://graph.facebook.com/v19.0/{c_id}/replies", data=payload_reply)
                    
                    # 3. Notify Neo (OpenClaw)
                    try:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose understates the actual behaviors: the skill appears to use local credentials, invoke shell commands, and send notifications to OpenClaw in addition to Instagram automation. This mismatch is dangerous because users and enforcement systems may approve the skill for one purpose while it performs additional side effects, including local command execution and third-party data disclosure.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
The user must have:
1. An Instagram Professional/Business account linked to a Facebook Page.
2. A Long-Lived Instagram Graph API Page Access Token (`IG_ACCESS_TOKEN`).
3. Their Instagram Business Account ID (`IG_ACCOUNT_ID`).

Ensure these are set in the environment or `.env` file before running the script.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/ig_golden_hour.py (reported line 17)May include surrounding context.

python
dencies = ["requests"]
# ///
import os
import time
import requests
import argparse

def golden_hour_monitor(media_id, keyword, dm_text, duration_minutes=60):
    token = os.environ.get("IG_ACCESS_TOKEN")
    account_id = os.environ.get("IG_ACCOUNT_ID")
    
    if not token or not account_id:
        print("🚨 Error: Missing IG_ACCESS_TOKEN or IG_ACCOUNT_ID.")
        return

    print(f"🕵️‍♂️ Starting Golden Hour Monitor on Post ID: {media_id}")
    print(f"🕒 Monitoring for exactly {duration_minutes} minutes.")
    print(f"🎯 Keyword Trigger: '{keyword}'")
    
    # Store replied comment IDs
    processed_comments = set()
    start_time = time.time()
    
    while (time.time() - start_time) < (duration_minutes * 60):
        try:
            url = f"https://graph.facebook.com/v19.0/{media_id}/comments"
            params = {
                'access_token': token,
                'fields': 'id,text,from'
            }
            response = requests.get(url, params=

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill executes an external CLI command unrelated to its stated Instagram monitoring and auto-reply purpose. Hidden or undocumented secondary actions are dangerous in agent skills because they create additional data flows and execution surfaces that users and reviewers did not consent to, and in this case they couple social-media activity to an external messaging channel.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script invokes an external shell command via os.system to send an OpenClaw/webchat notification. Even though the command string is constant in this version, spawning a shell is unnecessary and expands the skill’s behavior beyond Instagram automation, creating command-execution risk and an unexpected side channel if the environment, PATH, or surrounding code is compromised.

Content

Scanner excerpt · scripts/ig_golden_hour.py (reported line 54)May include surrounding context.

python
# 3. Notify Neo (OpenClaw)
                    try:
                        os.system(f"openclaw message send --target webchat --message '🚨 SUCCESS! I just sent the Mock Trading DM to an Instagram user who commented \"BOT\".'")
                    except:
                        pass

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares no explicit tool scope or permissions even though its documented behavior requires environment access, network access, and shell execution. In an agent setting, missing capability declarations weaken user consent and policy enforcement, making it easier for the skill to access credentials or perform actions outside what the user clearly authorized.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description does not clearly warn that it will automatically post public replies and send direct messages on the user's behalf. That omission is risky because it can cause unintended impersonation, spam-like behavior, or account-policy violations if a user enables the skill without understanding the automated actions it will take.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to place a long-lived Instagram access token in environment variables or a .env file without any handling or storage warning. Long-lived tokens can grant broad account access, so weak guidance increases the chance of accidental leakage through logs, source control, misconfigured hosts, or other local tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script polls the Facebook Graph API for comment data using fields that include comment text and sender information (id,text,from). While it prints that monitoring has started, it does not clearly disclose that user comment content and metadata will be fetched from Instagram/Facebook and processed continuously. This is a network operation involving user data, which falls under the missing-warning criteria for code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Although the script logs each action at send time, it lacks an explicit advance disclosure that matching comments will trigger both a DM and a public reply. These are user-affecting outbound network actions, and the warning should be clear before execution rather than only when an individual message is sent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ig_golden_hour.py (reported line 45)May include surrounding context.

python
# 1. Send the Private DM Reply
                    print(f"📨 Sliding into DMs: {dm_text}")
                    payload = { "recipient": { "comment_id": c_id }, "message": { "text": dm_text }, "access_token": token }
                    requests.post(f"https://graph.facebook.com/v19.0/me/messages", json=payload)
                    
                    # 2. Reply publicly to double the engagement
                    print(f"💬 Replying publicly to the comment ID: {c_id}")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code sends external notifications to OpenClaw/webchat, but this behavior is not described in the skill metadata. Undisclosed outbound communications are a security and trust problem because they can leak operational events or user-related activity to another system without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Executing an external shell command without warning or explanation is risky because it introduces behavior outside the user’s expected workflow and outside the declared scope of the skill. In an agent-skill context, undisclosed execution is especially suspicious because it may be used to trigger side effects or covert notifications.

Content

No source excerpt is available for this finding.