← Back to Skills Marketplace
97
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install viral-content-engine
Description
Find trending topics, create editorial-style social media graphics, and post to X/Twitter and Instagram. Includes image generation with photographic backgrou...
Usage Guidance
This skill's features align with its description, but it mishandles credentials and metadata is misleading. Before installing:
- Expect to provide OPENAI_API_KEY, BRAVE_API_KEY, and IG_USERNAME/IG_PASSWORD (the registry incorrectly lists none). Treat these as sensitive.
- Do not run it on a multi-user or shared machine: instagram-post.js builds a python -c command that contains your username/password in the command text, which can be visible to other local users via ps/psaux and logs. Better approaches are to use environment variables passed securely, a temporary file with restrictive permissions, or a proper OAuth/session flow.
- Inspect and control the ~/.openclaw directory: the skill will try to read ~/.openclaw/clawdbot.json for keys and will write ~/.openclaw/ig_session.json (containing session info). Review and remove saved session files when no longer needed and rotate passwords if used.
- If you need to run this, prefer running in an isolated VM/container, or modify instagram-post.js to invoke a short Python script file (not inline) and avoid embedding credentials in command lines.
- Confirm you trust the OpenAI key usage (image generations incur cost) and that storing IG credentials in a script/session fits your security posture.
If you want, ask for a secure remediation checklist (minimal code edits to avoid credential exposure) or for a specific code change to reduce the risks identified.
Capability Analysis
Type: OpenClaw Skill
Name: viral-content-engine
Version: 1.0.0
The skill bundle provides social media automation but contains high-risk coding patterns and handles sensitive credentials. Specifically, 'instagram-post.js' and 'viral-search.js' use 'execSync' to execute shell commands with string interpolation, which is highly vulnerable to shell injection. The bundle also manages sensitive data including Instagram passwords and API keys, storing session tokens in '~/.openclaw/ig_session.json'. While these capabilities are aligned with the stated purpose of content creation and posting, the implementation lacks robust input sanitization and relies on risky execution methods.
Capability Assessment
Purpose & Capability
The functionality (find trending content, generate images via OpenAI, and post to X/Instagram) matches the name and description. However the package registry metadata lists no required env vars while SKILL.md and the scripts require several secrets (OPENAI_API_KEY, BRAVE_API_KEY, IG_USERNAME/IG_PASSWORD) and external tools (bird CLI, instagrapi). That metadata mismatch is misleading.
Instruction Scope
The runtime instructions and included scripts do more than a simple 'generate-and-post' flow: they read a user OpenClaw config file (~/.openclaw/clawdbot.json) to obtain a Brave API key, write a persistent session file (~/.openclaw/ig_session.json), and construct/execute an inline Python script via shell. The instagram-post flow inlines credentials into a python -c command string, which can expose secrets in process listings. These behaviors expand scope to the user's filesystem and long-lived session data.
Install Mechanism
This is an instruction-only skill with bundled scripts and no install spec or remote downloads. No extra packages are automatically fetched by the skill installer itself (lowest installer risk).
Credentials
The skill legitimately needs an OpenAI key to generate images and IG credentials to post, and a Brave search key to scrape Instagram via Brave. But the registry claims no required env vars while the code expects them. Additionally, the skill reads an OpenClaw config file for keys (potentially exposing other stored secrets), persists an IG session file in the user's home directory, and inlines usernames/passwords in a shell command (exposes them to other local users/process inspections). These are disproportionate privacy/secret-handling risks if not understood.
Persistence & Privilege
The skill saves an Instagram session file at ~/.openclaw/ig_session.json and reads/writes into ~/.openclaw. That creates persistent credentials/session state on disk. The skill is not always: true, but its file persistence and session-saving behavior increases its long-term footprint and the impact of compromised credentials.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install viral-content-engine - After installation, invoke the skill by name or use
/viral-content-engine - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Your AI-powered Instagram content team in a single skill.
Give it a topic → it researches what's trending and viral on X and Instagram → generates editorial-style carousel graphics (photographic backgrounds, dark gradient overlays, bold Bloomberg/Kalshi typography) → posts directly to Instagram and X.
Find: Viral content search with engagement scoring across X/Twitter and Instagram. Trending mode shows what's blowing up right now.
Create: OpenAI gpt-image-1 powered image generation with a battle-tested prompt template that produces consistent, professional editorial graphics every time.
Post: Direct publishing to Instagram (photos, reels, stories, carousels) and X/Twitter with media support.
No paid social APIs needed. Just plug in your OpenAI key and go.
Metadata
Frequently Asked Questions
What is Insta Content Engine?
Find trending topics, create editorial-style social media graphics, and post to X/Twitter and Instagram. Includes image generation with photographic backgrou... It is an AI Agent Skill for Claude Code / OpenClaw, with 97 downloads so far.
How do I install Insta Content Engine?
Run "/install viral-content-engine" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Insta Content Engine free?
Yes, Insta Content Engine is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Insta Content Engine support?
Insta Content Engine is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Insta Content Engine?
It is built and maintained by kash (@ashmonmc); the current version is v1.0.0.
More Skills