← 返回 Skills 市场
uyeong

Instagram Content Studio

作者 U-Yeong Ju · GitHub ↗ · v1.0.2
cross-platform ⚠ suspicious
1389
总下载
1
收藏
3
当前安装
3
版本数
在 OpenClaw 中安装
/install instagram-content-studio
功能描述
Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests an...
使用说明 (SKILL.md)

Instagram API Skill

A skill for managing an Instagram account via the Instagram Graph API. Supports profile viewing, post management, image publishing, video/Reels publishing, and comment operations.

Prerequisites

  • A .env file with credentials must be configured.
    • Required: INSTAGRAM_ACCESS_TOKEN
    • Recommended (for comment/reply via Facebook Graph): FACEBOOK_USER_ACCESS_TOKEN
    • Required for FB token refresh: FACEBOOK_APP_ID, FACEBOOK_APP_SECRET
  • cloudflared must be installed for local image/video posting.
  • If the user specifies a .env file path, append --env \x3Cpath> to every command.
    • Example: node scripts/get-profile.js --env /home/user/.instagram-env
  • All scripts must be run with this project root as the working directory.

Available Commands

All commands automatically refresh the token before execution. No manual refresh needed.

Refresh Token

# Instagram token refresh
node scripts/refresh-token.js

# Facebook user token refresh (for comments/replies flow)
node scripts/refresh-facebook-token.js

Manually refreshes token(s) and returns expiration info.

View Profile

node scripts/get-profile.js

Returns profile info (name, username, account type, media count).

List Posts

node scripts/get-posts.js [--limit 10]

Returns the user's post list. Use --limit to set the count (default: 10).

View Post Detail

node scripts/get-post.js \x3Cmedia-id>

Returns post detail including like count and comment count.

Publish Image

# Single image (URL)
node scripts/post-image.js --caption "Caption" https://example.com/photo.jpg

# Single image (local file)
node scripts/post-image.js --caption "Caption" ./photos/image.png

# Carousel — multiple images (URL)
node scripts/post-image.js --caption "Caption" https://example.com/a.jpg https://example.com/b.jpg

# Carousel — multiple images (local files)
node scripts/post-image.js --caption "Caption" ./img1.png ./img2.png ./img3.jpg
  • 1 image → single post, 2+ images → automatically posted as carousel (max 10).
  • Both URLs (http://, https://) and local file paths are supported, but mixing is not allowed.
  • Supported local file formats: jpg, jpeg, png, gif, webp, heic/heif (HEIC is automatically converted to JPEG).

Publish Video (Reels)

# Single video (URL)
node scripts/post-video.js --caption "Caption" https://example.com/video.mp4

# Single video (local file)
node scripts/post-video.js --caption "Caption" ./videos/clip.mp4

# With cover image and options
node scripts/post-video.js --caption "Caption" --cover https://example.com/cover.jpg --thumb-offset 5000 --share-to-feed true https://example.com/video.mp4

# Video carousel — multiple videos (URL)
node scripts/post-video.js --caption "Caption" https://example.com/a.mp4 https://example.com/b.mp4

# Video carousel — multiple videos (local files)
node scripts/post-video.js --caption "Caption" ./clip1.mp4 ./clip2.mov
  • 1 video → Reels post, 2+ videos → automatically posted as carousel (max 10).
  • Both URLs and local file paths are supported, but mixing is not allowed.
  • Supported formats: mp4, mov (max 100MB per file).
  • --cover, --thumb-offset, --share-to-feed options are only available for single video posts (not carousels).
  • Video processing takes longer than images; the script waits up to 10 minutes.

View Comments

node scripts/get-comments.js \x3Cmedia-id>

Returns comments and replies for a specific post.

Post Comment

node scripts/post-comment.js \x3Cmedia-id> --text "Comment text"

Reply to Comment

node scripts/reply-comment.js \x3Ccomment-id> --text "Reply text"

Workflow Guidelines

  • When publishing images or videos, always confirm the caption with the user before executing.
  • After publishing, report the result ID and permalink to the user (both are included in the output).
  • Video processing takes longer than images. Inform the user that it may take a few minutes.
  • When writing comments/replies, confirm the content with the user before executing.
  • All command outputs are in JSON format.

Error Handling

If the output contains an error field, an error has occurred. Explain the cause to the user and suggest a resolution.

{ "error": "error message" }

Security

Token storage

  • refreshIgToken() and refreshFbToken() overwrite tokens in the .env file in plaintext. Do not commit .env to version control.
  • Create a dedicated Meta app with minimum required permissions (see below).

Local file upload

  • Local image/video posting starts a temporary cloudflared Quick Tunnel to expose files so Instagram servers can download them.
  • The tunnel is active only during the upload and is shut down immediately after.
  • Only provide file paths you are comfortable briefly exposing to the internet.

Minimum required permissions

When creating your Meta app, grant only these permissions:

  • instagram_business_basic — profile and media read
  • instagram_content_publish — image/video publishing
  • instagram_manage_comments — comment read/write
  • pages_read_engagement — required for comment API via Facebook Graph
  • pages_show_list — required for page-linked Instagram accounts
安全使用建议
What to check before installing: - Metadata mismatch: the registry entry claims no required env vars, but the skill requires INSTAGRAM_ACCESS_TOKEN and optionally FACEBOOK_USER_ACCESS_TOKEN / FACEBOOK_APP_ID / FACEBOOK_APP_SECRET. Treat the SKILL.md and scripts as authoritative. - Tokens: the scripts automatically refresh and overwrite values in a local .env file in plaintext. Do not keep secrets in a repository; use a dedicated .env and restrict filesystem access. Review _common.js (refreshIgToken/refreshFbToken) if you need to be certain how tokens are updated. - Local-file uploads: posting local images/videos starts a cloudflared Quick Tunnel that briefly exposes the given files to the public internet. Only provide files you are comfortable exposing and verify cloudflared is installed from an official source. - Autonomous invocation: platform default allows the agent to call the skill without an explicit user action. If you want manual approval before any publish or file-exposing action, disable autonomous invocation or require the agent to ask for confirmation. The SKILL.md's guidance to confirm captions/comments is not an enforced safeguard. - Review code and run in isolation: if you plan to use this, audit the provided scripts (especially _common.js and tunnel logic), run npm install in a sandbox or container, and consider limiting permissions by creating a dedicated Meta app with only the listed minimal permissions. - If unsure: do not supply production credentials. Test with a throwaway Instagram account and app first.
功能分析
Type: OpenClaw Skill Name: instagram-content-studio Version: 1.0.2 The skill is highly suspicious due to critical vulnerabilities that enable data exfiltration and potential system compromise through prompt injection. Specifically, the `SKILL.md` and `README.md` instruct the agent to accept arbitrary local file paths for media uploads, which are then read by `scripts/_common.js` (e.g., `postLocalImage`, `postLocalVideo`) and exposed via a temporary `cloudflared` tunnel without path sanitization, allowing exfiltration of sensitive files like `~/.ssh/id_rsa`. Additionally, the agent is instructed to append `--env <path>` for custom .env files, and `scripts/_common.js`'s `refreshIgToken` and `refreshFbToken` functions will then overwrite this arbitrary file with access tokens, posing a risk of system disruption or persistence by targeting files like `/etc/crontab`.
能力评估
Purpose & Capability
The scripts and SKILL.md clearly require an INSTAGRAM_ACCESS_TOKEN (and optionally FACEBOOK_USER_ACCESS_TOKEN, FACEBOOK_APP_ID/SECRET) and Node + cloudflared, which are appropriate for an Instagram management tool — but the registry metadata claims no required env vars/config paths. That metadata mismatch is an incoherence that could mislead users about what secrets and tooling this skill needs.
Instruction Scope
Runtime instructions and scripts instruct the agent to load and overwrite a local .env file, refresh and persist tokens, read local media files, and start a cloudflared tunnel that briefly exposes local files to the public internet. Those behaviors are within the stated goal (publishing local media) but elevate risk: token persistence and temporary public exposure of arbitrary local paths are sensitive operations and should be explicitly authorized by the user each time.
Install Mechanism
There is no install spec in the registry (instruction-only), but the package includes Node scripts and package.json/package-lock.json; README instructs running npm install. Dependencies (dotenv, sharp) are reasonable for image/video handling. The missing install metadata is an inconsistency but not inherently malicious.
Credentials
The env vars required by the code (INSTAGRAM_ACCESS_TOKEN, and optionally FACEBOOK_USER_ACCESS_TOKEN, FACEBOOK_APP_ID, FACEBOOK_APP_SECRET) are appropriate for Graph API operations. However the registry metadata omitted these requirements. The code persists refreshed tokens and Facebook user tokens back into the .env file in plaintext, and requires the app secret to perform FB token refresh — both are sensitive and warrant caution.
Persistence & Privilege
always:false and the skill confines changes to its own .env file; it does not request system-wide modifications. Still, the skill can be invoked autonomously (platform default) and when invoked it can read local files and start a cloudflared tunnel to publish them; combined, that increases potential impact if an agent acts without explicit confirmation.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install instagram-content-studio
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /instagram-content-studio 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.2
- Added a new script: `refresh-facebook-token.js` for refreshing Facebook user access tokens. - Updated documentation to include Facebook token refresh command and additional credential/environment variable requirements. - Expanded security guidelines for token and file handling. - Clarified required and recommended permissions for Meta app configuration.
v1.0.1
- Added a new compatibility section specifying required node version, npm, cloudflared, environment variables, and internet access. - Included a metadata block with version information. - No changes to commands or feature set.
v1.0.0
instagram-content-studio Skill v1.0.0 - Initial release providing Instagram account management via the Instagram Graph API. - Supports viewing profile, listing posts, viewing post details, publishing images/carousels, posting videos/Reels (including carousels), and managing comments (read/write/reply). - Accepts both image/video URLs and local files (with format conversion for HEIC images). - Includes error handling guidance and workflow best practices. - All tool commands output JSON for easy processing.
元数据
Slug instagram-content-studio
版本 1.0.2
许可证
累计安装 4
当前安装数 3
历史版本数 3
常见问题

Instagram Content Studio 是什么?

Manage an Instagram account. View profile, list posts, publish images/carousels, publish videos/Reels, and read/write comments. Use when the user requests an... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 1389 次。

如何安装 Instagram Content Studio?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install instagram-content-studio」即可一键安装,无需额外配置。

Instagram Content Studio 是免费的吗?

是的,Instagram Content Studio 完全免费(开源免费),可自由下载、安装和使用。

Instagram Content Studio 支持哪些平台?

Instagram Content Studio 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Instagram Content Studio?

由 U-Yeong Ju(@uyeong)开发并维护,当前版本 v1.0.2。

💬 留言讨论