← 返回 Skills 市场

Instagram Skill via cyberdrk/gram CLI

Name: Instagram Skill via cyberdrk/gram CLI
Author: arein

作者 arein · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

3152

总下载

当前安装

版本数

在 OpenClaw 中安装

/install gram

功能描述

Instagram CLI for viewing feeds, posts, profiles, and engagement via cookies.

使用说明 (SKILL.md)

gram 📸

Instagram CLI using REST/GraphQL API + cookie auth.

Install

# npm/pnpm/bun
npm install -g @cyberdrk/gram

# One-shot (no install)
bunx @cyberdrk/gram whoami

Authentication

gram uses cookie-based auth from your Instagram web session.

Use --session-id, --csrf-token, and --ds-user-id to pass cookies directly, or --cookie-source for browser cookies.

Run gram check to see which source is active. For Arc/Brave, use --chrome-profile-dir \x3Cpath>.

Commands

Account & Auth

gram whoami                    # Show logged-in account
gram check                     # Show credential sources
gram query-ids --refresh       # Refresh GraphQL query ID cache

Reading Posts

gram post \x3Cshortcode-or-url>   # View a post
gram \x3Cshortcode-or-url>        # Shorthand for post
gram comments \x3Cshortcode> -n 20 # View comments on a post
gram likers \x3Cshortcode>        # View users who liked a post

Feeds

gram feed -n 20                # Home feed
gram explore -n 20             # Explore/discover feed

User Profiles

gram user \x3Cusername>           # View user profile
gram user @instagram --json    # JSON output
gram posts \x3Cusername> -n 20    # User's posts
gram following [username]      # Users someone follows (defaults to you)
gram followers [username]      # Someone's followers (defaults to you)

Search

gram search "query"            # Search users, hashtags, places
gram search "coffee" --type users
gram search "nyc" --type places
gram search "#photography" --type hashtags

Engagement Actions

gram like \x3Cshortcode>          # Like a post
gram unlike \x3Cshortcode>        # Unlike a post
gram save \x3Cshortcode>          # Save/bookmark a post
gram unsave \x3Cshortcode>        # Unsave a post
gram comment \x3Cshortcode> "nice!" # Comment on a post
gram follow \x3Cusername>         # Follow a user
gram unfollow \x3Cusername>       # Unfollow a user

Output Options

--json          # JSON output
--json-full     # JSON with raw API response in _raw field
--plain         # No emoji, no color (script-friendly)
--no-emoji      # Disable emoji
--no-color      # Disable ANSI colors (or set NO_COLOR=1)

Global Options

--session-id \x3Ctoken>           # Instagram sessionid cookie
--csrf-token \x3Ctoken>           # Instagram csrftoken cookie
--ds-user-id \x3Cid>              # Instagram ds_user_id cookie
--cookie-source \x3Csource>       # Cookie source for browser cookies (repeatable)
--chrome-profile \x3Cname>        # Chrome profile name
--chrome-profile-dir \x3Cpath>    # Chrome/Chromium profile dir or cookie DB path
--firefox-profile \x3Cname>       # Firefox profile
--timeout \x3Cms>                 # Request timeout
--cookie-timeout \x3Cms>          # Cookie extraction timeout

Config File

~/.config/gram/config.json5 (global) or ./.gramrc.json5 (project):

{
  cookieSource: ["safari", "chrome"],
  chromeProfile: "Profile 1",
  timeoutMs: 60000
}

Environment variables: GRAM_TIMEOUT_MS, GRAM_COOKIE_TIMEOUT_MS

Troubleshooting

Query IDs stale (404 errors)

gram query-ids --refresh

Cookie extraction fails

Check browser is logged into Instagram
Try different --cookie-source
For Arc/Brave: use --chrome-profile-dir
Provide cookies manually: --session-id, --csrf-token, --ds-user-id

User-agent mismatch errors

The CLI uses desktop user-agent by default
If your session was created on mobile, it may fail
Create a new session by logging in via desktop browser

TL;DR: View feeds, profiles, search, and engage with Instagram via CLI. 📸

安全使用建议

This skill appears to do what it says (an Instagram CLI using cookies) but it requires sensitive access: you must provide Instagram session cookies or point it at browser profile cookie DBs. Before installing or using it: 1) Verify the npm package and maintainer (review the GitHub repo and npm page) instead of blindly trusting the package name. 2) Prefer supplying cookies/tokens manually (via --session-id, --csrf-token, --ds-user-id) rather than giving the tool a browser profile directory so it cannot read unrelated cookies. 3) If you do allow cookie extraction, limit the path you give it and run it in a safe environment; browser cookie DBs may contain other sites' credentials. 4) Be cautious with engagement commands (like/comment/follow) — consider using the tool read-only or requiring confirmation before any action that changes your account. 5) Avoid global installs on sensitive machines; consider containerizing or running in a throwaway environment. 6) If you enable agent/autonomous invocation, restrict or monitor it to prevent unexpected actions on your account. If you want more assurance, ask for the exact npm package version, a link to its release tarball, or a short audit of the package source before installing.

功能分析

Type: OpenClaw Skill Name: gram Version: 1.0.0 The skill bundle is classified as suspicious due to its explicit instructions in SKILL.md for the `gram` CLI tool to access sensitive browser cookie databases via options like `--cookie-source`, `--chrome-profile-dir`, and `--firefox-profile`. While this capability is plausibly needed for the stated purpose of an Instagram CLI using cookie-based authentication, it represents a high-risk operation. There is no clear evidence of intentional malicious behavior like exfiltration or persistence within the provided files, but the direct access to browser data makes it a significant security concern.

能力评估

✓ Purpose & Capability

Name/description, required binary ('gram'), and the install spec for @cyberdrk/gram align with an Instagram CLI that authenticates with cookies and performs read and engagement actions.

⚠ Instruction Scope

Instructions explicitly describe extracting cookies from browser profiles or accepting sessionid/csrf/ds_user_id tokens. Reading browser profile dirs or cookie DBs can expose other site cookies if misused; the skill also supports actions (like, comment, follow) which can modify the user's account. These behaviors are coherent with the stated purpose but are sensitive and should be handled carefully.

ℹ Install Mechanism

Install is an npm package (@cyberdrk/gram) which is a typical distribution method for CLIs. Npm packages are moderate risk compared to pre-vetted system packages — verify publisher/release and review package before global install.

ℹ Credentials

No required environment variables or unrelated credentials are declared. The skill expects cookie/session tokens or access to browser cookie stores — that is proportionate to Instagram access but is high-sensitivity data.

⚠ Persistence & Privilege

always:false (good). However, the skill can perform account-changing actions (like/comment/follow). If the agent is allowed to invoke the skill autonomously, it could perform those actions on your behalf — consider restricting autonomous invocation or requiring explicit user confirmation for engagement commands.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install gram
安装完成后，直接呼叫该 Skill 的名称或使用 /gram 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of gram: an Instagram CLI. - View Instagram feeds, posts, profiles, and engagement using your session cookies. - Supports reading feeds, posts, user profiles, followers, and search. - Features engagement actions: like, save, comment, follow/unfollow. - Cookie-based authentication via direct arguments or browser extraction. - Provides script-friendly and JSON output options. - Includes troubleshooting and config file support.

元数据

Slug gram

版本 1.0.0

许可证 —

累计安装 8

当前安装数 8

历史版本数 1

常见问题