Upload Instagram posts via browser automation. Use when uploading images to Instagram, creating Instagram posts, or automating Instagram content publishing....

What to consider before installing/using: - Functionality: The script automates an Instagram post by connecting to your local OpenClaw browser CDP (default 127.0.0.1:18800). It will act as the currently logged-in browser user — if that session is logged into your Instagram account it can publish on your behalf. - Inconsistencies: SKILL.md shows a Quick Upload command calling 'scripts/post.sh' but the package contains scripts/post.js. The README/installation does not list required npm packages (puppeteer-core, commander). Expect to manually install dependencies and verify the correct command before running. - Risk surface: No external endpoints or secret env vars are requested, but because the skill drives your browser it can interact with any open tabs or UI elements if selectors mis-target. Test in a controlled environment (e.g., a disposable/test Instagram account and test browser/profile) before using with your primary account. - Operational safety: Verify and run the script locally after inspecting it. Ensure OpenClaw/browser is bound to localhost and the port is correct. Avoid running on a machine with other sensitive logged-in sessions. Check console output for any unexpected network endpoints or logs before giving it broader use. - What would increase trust: a corrected SKILL.md (accurate run command), a package.json listing explicit dependencies and versions, an install spec or instructions, and clearer owner/contact info. If you want higher assurance, request a checksumed release or a source provenance link (GitHub repo/release) and a short changelog.

Type: OpenClaw Skill Name: insta-post Version: 1.0.1 The skill is classified as suspicious due to the `scripts/post.js` file's capability to upload arbitrary local files specified by path to Instagram. While the script's stated purpose is to upload images, it does not strictly validate file types beyond a warning for PNGs. This presents a vulnerability where a compromised AI agent or a malicious prompt could instruct the skill to upload sensitive non-image files (e.g., configuration files, logs, or even credentials if disguised or accepted by Instagram's server-side validation) to a public Instagram post, leading to potential data exfiltration. The `SKILL.md` does not contain prompt injection attempts, and the script does not exhibit clear malicious intent like seeking out sensitive files or exfiltrating data to unauthorized endpoints, but its broad file upload capability is a significant risk.