← Back to Skills Marketplace
uyeong

Instagram Content Studio

by U-Yeong Ju · GitHub ↗ · v1.0.2
cross-platform ⚠ suspicious
1389
Downloads
1
Stars
3
Active Installs
3
Versions
Install in OpenClaw
/install instagram-content-studio
Description
Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests an...
README (SKILL.md)

Instagram API Skill

A skill for managing an Instagram account via the Instagram Graph API. Supports profile viewing, post management, image publishing, video/Reels publishing, and comment operations.

Prerequisites

  • A .env file with credentials must be configured.
    • Required: INSTAGRAM_ACCESS_TOKEN
    • Recommended (for comment/reply via Facebook Graph): FACEBOOK_USER_ACCESS_TOKEN
    • Required for FB token refresh: FACEBOOK_APP_ID, FACEBOOK_APP_SECRET
  • cloudflared must be installed for local image/video posting.
  • If the user specifies a .env file path, append --env \x3Cpath> to every command.
    • Example: node scripts/get-profile.js --env /home/user/.instagram-env
  • All scripts must be run with this project root as the working directory.

Available Commands

All commands automatically refresh the token before execution. No manual refresh needed.

Refresh Token

# Instagram token refresh
node scripts/refresh-token.js

# Facebook user token refresh (for comments/replies flow)
node scripts/refresh-facebook-token.js

Manually refreshes token(s) and returns expiration info.

View Profile

node scripts/get-profile.js

Returns profile info (name, username, account type, media count).

List Posts

node scripts/get-posts.js [--limit 10]

Returns the user's post list. Use --limit to set the count (default: 10).

View Post Detail

node scripts/get-post.js \x3Cmedia-id>

Returns post detail including like count and comment count.

Publish Image

# Single image (URL)
node scripts/post-image.js --caption "Caption" https://example.com/photo.jpg

# Single image (local file)
node scripts/post-image.js --caption "Caption" ./photos/image.png

# Carousel — multiple images (URL)
node scripts/post-image.js --caption "Caption" https://example.com/a.jpg https://example.com/b.jpg

# Carousel — multiple images (local files)
node scripts/post-image.js --caption "Caption" ./img1.png ./img2.png ./img3.jpg
  • 1 image → single post, 2+ images → automatically posted as carousel (max 10).
  • Both URLs (http://, https://) and local file paths are supported, but mixing is not allowed.
  • Supported local file formats: jpg, jpeg, png, gif, webp, heic/heif (HEIC is automatically converted to JPEG).

Publish Video (Reels)

# Single video (URL)
node scripts/post-video.js --caption "Caption" https://example.com/video.mp4

# Single video (local file)
node scripts/post-video.js --caption "Caption" ./videos/clip.mp4

# With cover image and options
node scripts/post-video.js --caption "Caption" --cover https://example.com/cover.jpg --thumb-offset 5000 --share-to-feed true https://example.com/video.mp4

# Video carousel — multiple videos (URL)
node scripts/post-video.js --caption "Caption" https://example.com/a.mp4 https://example.com/b.mp4

# Video carousel — multiple videos (local files)
node scripts/post-video.js --caption "Caption" ./clip1.mp4 ./clip2.mov
  • 1 video → Reels post, 2+ videos → automatically posted as carousel (max 10).
  • Both URLs and local file paths are supported, but mixing is not allowed.
  • Supported formats: mp4, mov (max 100MB per file).
  • --cover, --thumb-offset, --share-to-feed options are only available for single video posts (not carousels).
  • Video processing takes longer than images; the script waits up to 10 minutes.

View Comments

node scripts/get-comments.js \x3Cmedia-id>

Returns comments and replies for a specific post.

Post Comment

node scripts/post-comment.js \x3Cmedia-id> --text "Comment text"

Reply to Comment

node scripts/reply-comment.js \x3Ccomment-id> --text "Reply text"

Workflow Guidelines

  • When publishing images or videos, always confirm the caption with the user before executing.
  • After publishing, report the result ID and permalink to the user (both are included in the output).
  • Video processing takes longer than images. Inform the user that it may take a few minutes.
  • When writing comments/replies, confirm the content with the user before executing.
  • All command outputs are in JSON format.

Error Handling

If the output contains an error field, an error has occurred. Explain the cause to the user and suggest a resolution.

{ "error": "error message" }

Security

Token storage

  • refreshIgToken() and refreshFbToken() overwrite tokens in the .env file in plaintext. Do not commit .env to version control.
  • Create a dedicated Meta app with minimum required permissions (see below).

Local file upload

  • Local image/video posting starts a temporary cloudflared Quick Tunnel to expose files so Instagram servers can download them.
  • The tunnel is active only during the upload and is shut down immediately after.
  • Only provide file paths you are comfortable briefly exposing to the internet.

Minimum required permissions

When creating your Meta app, grant only these permissions:

  • instagram_business_basic — profile and media read
  • instagram_content_publish — image/video publishing
  • instagram_manage_comments — comment read/write
  • pages_read_engagement — required for comment API via Facebook Graph
  • pages_show_list — required for page-linked Instagram accounts
Usage Guidance
What to check before installing: - Metadata mismatch: the registry entry claims no required env vars, but the skill requires INSTAGRAM_ACCESS_TOKEN and optionally FACEBOOK_USER_ACCESS_TOKEN / FACEBOOK_APP_ID / FACEBOOK_APP_SECRET. Treat the SKILL.md and scripts as authoritative. - Tokens: the scripts automatically refresh and overwrite values in a local .env file in plaintext. Do not keep secrets in a repository; use a dedicated .env and restrict filesystem access. Review _common.js (refreshIgToken/refreshFbToken) if you need to be certain how tokens are updated. - Local-file uploads: posting local images/videos starts a cloudflared Quick Tunnel that briefly exposes the given files to the public internet. Only provide files you are comfortable exposing and verify cloudflared is installed from an official source. - Autonomous invocation: platform default allows the agent to call the skill without an explicit user action. If you want manual approval before any publish or file-exposing action, disable autonomous invocation or require the agent to ask for confirmation. The SKILL.md's guidance to confirm captions/comments is not an enforced safeguard. - Review code and run in isolation: if you plan to use this, audit the provided scripts (especially _common.js and tunnel logic), run npm install in a sandbox or container, and consider limiting permissions by creating a dedicated Meta app with only the listed minimal permissions. - If unsure: do not supply production credentials. Test with a throwaway Instagram account and app first.
Capability Analysis
Type: OpenClaw Skill Name: instagram-content-studio Version: 1.0.2 The skill is highly suspicious due to critical vulnerabilities that enable data exfiltration and potential system compromise through prompt injection. Specifically, the `SKILL.md` and `README.md` instruct the agent to accept arbitrary local file paths for media uploads, which are then read by `scripts/_common.js` (e.g., `postLocalImage`, `postLocalVideo`) and exposed via a temporary `cloudflared` tunnel without path sanitization, allowing exfiltration of sensitive files like `~/.ssh/id_rsa`. Additionally, the agent is instructed to append `--env <path>` for custom .env files, and `scripts/_common.js`'s `refreshIgToken` and `refreshFbToken` functions will then overwrite this arbitrary file with access tokens, posing a risk of system disruption or persistence by targeting files like `/etc/crontab`.
Capability Assessment
Purpose & Capability
The scripts and SKILL.md clearly require an INSTAGRAM_ACCESS_TOKEN (and optionally FACEBOOK_USER_ACCESS_TOKEN, FACEBOOK_APP_ID/SECRET) and Node + cloudflared, which are appropriate for an Instagram management tool — but the registry metadata claims no required env vars/config paths. That metadata mismatch is an incoherence that could mislead users about what secrets and tooling this skill needs.
Instruction Scope
Runtime instructions and scripts instruct the agent to load and overwrite a local .env file, refresh and persist tokens, read local media files, and start a cloudflared tunnel that briefly exposes local files to the public internet. Those behaviors are within the stated goal (publishing local media) but elevate risk: token persistence and temporary public exposure of arbitrary local paths are sensitive operations and should be explicitly authorized by the user each time.
Install Mechanism
There is no install spec in the registry (instruction-only), but the package includes Node scripts and package.json/package-lock.json; README instructs running npm install. Dependencies (dotenv, sharp) are reasonable for image/video handling. The missing install metadata is an inconsistency but not inherently malicious.
Credentials
The env vars required by the code (INSTAGRAM_ACCESS_TOKEN, and optionally FACEBOOK_USER_ACCESS_TOKEN, FACEBOOK_APP_ID, FACEBOOK_APP_SECRET) are appropriate for Graph API operations. However the registry metadata omitted these requirements. The code persists refreshed tokens and Facebook user tokens back into the .env file in plaintext, and requires the app secret to perform FB token refresh — both are sensitive and warrant caution.
Persistence & Privilege
always:false and the skill confines changes to its own .env file; it does not request system-wide modifications. Still, the skill can be invoked autonomously (platform default) and when invoked it can read local files and start a cloudflared tunnel to publish them; combined, that increases potential impact if an agent acts without explicit confirmation.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install instagram-content-studio
  3. After installation, invoke the skill by name or use /instagram-content-studio
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
- Added a new script: `refresh-facebook-token.js` for refreshing Facebook user access tokens. - Updated documentation to include Facebook token refresh command and additional credential/environment variable requirements. - Expanded security guidelines for token and file handling. - Clarified required and recommended permissions for Meta app configuration.
v1.0.1
- Added a new compatibility section specifying required node version, npm, cloudflared, environment variables, and internet access. - Included a metadata block with version information. - No changes to commands or feature set.
v1.0.0
instagram-content-studio Skill v1.0.0 - Initial release providing Instagram account management via the Instagram Graph API. - Supports viewing profile, listing posts, viewing post details, publishing images/carousels, posting videos/Reels (including carousels), and managing comments (read/write/reply). - Accepts both image/video URLs and local files (with format conversion for HEIC images). - Includes error handling guidance and workflow best practices. - All tool commands output JSON for easy processing.
Metadata
Slug instagram-content-studio
Version 1.0.2
License
All-time Installs 4
Active Installs 3
Total Versions 3
Frequently Asked Questions

What is Instagram Content Studio?

Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests an... It is an AI Agent Skill for Claude Code / OpenClaw, with 1389 downloads so far.

How do I install Instagram Content Studio?

Run "/install instagram-content-studio" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Instagram Content Studio free?

Yes, Instagram Content Studio is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Instagram Content Studio support?

Instagram Content Studio is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Instagram Content Studio?

It is built and maintained by U-Yeong Ju (@uyeong); the current version is v1.0.2.

💬 Comments