ClawHub
Back to skill

Security audit

Instagram Downloader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Instagram downloader, but it asks the agent to handle browser session cookies and run a shell command built from user input without enough safeguards.

Install only if you are comfortable letting the agent use an Instagram cookie file locally. Do not paste sessionid, csrftoken, or cookie contents into chat; keep the cookie file private, delete it when finished, avoid --no-check-certificate, and only run commands after validating the username, proxy, and file paths.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:15
Finding

Command Injection Through Unvalidated Download Parameters

Content
View full analysis
" --cookies "" -D "<目标目录>" "https://www.instagram.com/<用户名>/" ``` ### Technical Analysis The Instagram username, destination directory, cookie-file path, and proxy address all originate from user input. The Skill does not define strict validation, character allowlists, or shell-safe argument handling before inserting these values into a command template. Surrounding a value with double quotes is not a sufficient shell-injection defense. An attacker can supply a quote character to terminate the intended argument and then introduce command separators, command substitutions, newlines, or other syntax recognized by the relevant shell. Shell behavior varies by platform, but both Unix-like shells and Windows command interpreters have metacharacters that can alter the intended command structure. For example, if a Unix-like shell is used, a malicious username shaped like the following can terminate the URL argument and append another command: ```text victim"; touch /tmp/gallery-dl-injection; # ``` Textual substitution would produce a command structurally equivalent to: ```bash gallery-dl --proxy "" --cookies "" -D "" "https://www.instagram.com/victim"; touch /tmp/gallery-dl-injection; #/" ``` The `touch` operation is a non-destructive proof of concept. An attacker could substitute any command available to the Agent's operating-system account. The proxy and path parameters present similar risk ...[truncated 1671 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
82% confidence
Finding

The --cookies-from-browser chrome instruction triggers browser-cookie extraction behavior commonly associated with credential theft patterns, and in this skill it is directly tied to obtaining Instagram authenticated access. Although the apparent purpose is account-owner-assisted downloading rather than malware, the technique still handles highly sensitive credentials and increases the risk of token exposure, reuse, or over-collection beyond the minimum needed.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

6`

  • 主页链接可能是 https://www.instagram.com/fafa.0816/

2. 下载目录

  • 必须是完整绝对路径
  • Windows 示例：D:\Instagram\fafa.0816
  • Linux/Mac 示例：/home/user/downloads/instagram
  • gallery-dl 会在此目录下创建 instagram/<用户名>/ 子目录

3. Cookie 文件路径（Netscape 格式）

方法 A：用 yt-dlp 从 Chrome 导出

bash
yt-dlp --cookies-from-browser chrome --cookies "cookies_instagram.txt" "https://www.instagram.com/"

然后把 cookies_instagram.txt 路径告诉 agent。

方法 B：手动获取 sessionid

  1. 浏览器登录 Instagram
  2. F12 → Application → Cookies → 找 sessionid
  3. 写成 cookies_instagram.txt：
text
# Netscape HTTP Cookie File
.instagram.com	TRUE	/	FALSE	1800000000	sessionid	你的sessionid值
.instagram.com	TRUE	/	TRUE	1800000000	csrftoken	你的csrftoken值

4. 代理地址（可选）

  • 格式：http://127.0.0.1:7890
  • 如果用户不需要代理，直接留空

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The skill recommends using --no-check-certificate to work around SSL warnings from a proxy, which disables TLS certificate validation. That weakens transport security and can allow man-in-the-middle interception or tampering of requests, especially problematic when authenticated Instagram cookies are being used.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
| `401 Unauthorized` | Cookie 过期 | 重新获取 sessionid |
| `404 Not Found` | 用户不存在或私密 | 确认用户名正确 |
| `HttpError` 无权限 | Cookie 缺少必要字段 | 确保有 `sessionid` 和 `csrftoken` 两行 |
| SSL 警告 | 代理证书问题 | 加 `--no-check-certificate`（不推荐） |

## 隐私占位符清单

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the user to extract and supply Instagram authentication cookies, including sessionid and csrftoken, and to hand the resulting cookie file to the agent. Those are sensitive bearer-style credentials; if exposed, mishandled, logged, or reused outside the intended tool, they can enable account access or abuse. The lack of a clear warning about credential sensitivity and safe handling makes this materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill instructs execution of a download command that writes files to disk in a chosen directory. Although downloading is the skill's purpose, the markdown does not explicitly warn that the command will create directories and store potentially large amounts of content on the local filesystem.

Content

No source excerpt is available for this finding.