← 返回 Skills 市场

Instagram Poster

Name: Instagram Poster
Author: al1enjesus

作者 Ilya · GitHub ↗ · v1.0.0

linuxdarwinwin32 ⚠ suspicious

1780

总下载

当前安装

版本数

在 OpenClaw 中安装

/install instagram-poster

功能描述

Post images to Instagram automatically via Telegram. Generates images with WaveSpeed or uses your own. Bypasses Instagram bot detection using residential pro...

使用说明 (SKILL.md)

instagram-poster

Post images to Instagram directly from your AI agent — bypasses bot detection with a real residential IP.

Quick start

node {baseDir}/scripts/post.js \
  --image ./photo.jpg \
  --caption "Good morning 🌅 #photography" \
  --user YOUR_USERNAME \
  --pass YOUR_PASSWORD

Post a WaveSpeed-generated image:

# 1. Generate image
node /workspace/.agents/skills/wavespeed/scripts/wavespeed.js generate \
  --model flux-schnell --prompt "sunset over mountains" --output /tmp/post.png

# 2. Post to Instagram
node {baseDir}/scripts/post.js \
  --image /tmp/post.png \
  --caption "Golden hour 🏔️ #nature #photography"

Options

Flag	Env	Description
`--image`	`IG_IMAGE`	Local file path or HTTPS URL
`--caption`	`IG_CAPTION`	Post caption (optional)
`--user`	`IG_USERNAME`	Instagram username
`--pass`	`IG_PASSWORD`	Instagram password
`--session`	`IG_SESSION_PATH`	Cookie session file (default: `~/.openclaw/ig-session.json`)

Session caching

On first run, logs in and saves cookies to ~/.openclaw/ig-session.json. Subsequent runs reuse the session — no re-login needed.

Config in openclaw.json

{
  skills: {
    entries: {
      "instagram-poster": {
        env: {
          IG_USERNAME: "your_username",
          IG_PASSWORD: "your_password"
        }
      }
    }
  }
}

How it works

Launches a stealth browser with a Romanian residential IP (via human-browser)
Logs into Instagram as a real iPhone user — passes all bot checks
Uploads your image and submits the caption
Saves session cookies so you stay logged in

Requirements

human-browser skill installed
Human Browser subscription (residential proxy) → humanbrowser.dev
Instagram account credentials

Agent usage example

User: Post this sunset photo to Instagram with caption "Golden hour 🌅"
Agent: node {baseDir}/scripts/post.js --image /tmp/sunset.jpg --caption "Golden hour 🌅"

安全使用建议

This skill appears coherent for automating Instagram posts, but review these before installing: - Trust the human-browser service: it provides the residential proxy and fingerprinting; the skill relies on that external provider to bypass bot detection. - Protect your Instagram credentials: the skill requires IG_USERNAME/IG_PASSWORD and may be stored in your OpenClaw config or environment; prefer using a saved session file if you want to avoid putting passwords in config. Rotate credentials if you stop using the skill. - Be careful with image URLs: the script will download any user-supplied HTTPS URL. Do not instruct the agent to fetch internal or sensitive URLs that you don't want posted to Instagram. - Verify the human-browser dependency path: the script requires a local human-browser skill entry (relative path). Ensure that dependency is the official one you intend to use. - Because the code sample was truncated in the listing, consider reviewing the full scripts/post.js file in your environment before trusting it with credentials; if you need higher assurance, run it in an isolated environment or inspect the human-browser integration points.

功能分析

Type: OpenClaw Skill Name: instagram-poster Version: 1.0.0 The skill handles sensitive Instagram credentials (username, password) and stores session cookies locally in `~/.openclaw/ig-session.json` via `scripts/post.js`. While this is necessary for its stated purpose of automating Instagram posts, it represents a high-risk operation. The script also downloads images from arbitrary URLs or resolves local file paths provided by the user (`--image` argument), which could be exploited for path traversal (uploading sensitive local files to Instagram) or resource exhaustion (downloading large files) if a malicious user controls the input. There is no evidence of intentional malicious behavior like exfiltration to an unauthorized third party or backdoor installation, but these capabilities introduce significant vulnerabilities.

能力评估

✓ Purpose & Capability

Name/description (Instagram autoposter) match the declared requirements: IG_USERNAME/IG_PASSWORD, dependency on human-browser (residential proxy). The included scripts and README show code paths needed to log in and post images; these requirements are proportionate to the stated purpose.

ℹ Instruction Scope

SKILL.md and scripts instruct the agent to download images (HTTP/HTTPS), launch the human-browser skill, log in, and interact with Instagram UI. This stays within the posting scope, but the skill will download arbitrary URLs (user-supplied) and will read/write a session file (~/.openclaw/ig-session.json). If an agent or user supplies an internal URL, the skill could retrieve and upload that content — expected for a poster but worth noting.

✓ Install Mechanism

No install spec (instruction-only with shipped script) — lowest install risk. The code requires the human-browser skill to exist at a relative path; that dependency is declared. Nothing is downloaded from arbitrary URLs during install.

✓ Credentials

Only IG_USERNAME and IG_PASSWORD are required (plus optional IG_SESSION_PATH), which is appropriate for logging in. The skill saves session cookies locally; environment variables or config entries could store credentials in plaintext — a user-consent/secret-management consideration but proportionate to purpose.

ℹ Persistence & Privilege

always:false (normal). The skill saves session cookies to ~/.openclaw/ig-session.json so subsequent runs avoid re-login — expected for convenience. This is a persistent file in the user's home directory but does not modify other skills or system-wide settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install instagram-poster
安装完成后，直接呼叫该 Skill 的名称或使用 /instagram-poster 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: post images to Instagram from your AI agent using residential proxy

元数据

Slug instagram-poster

版本 1.0.0

许可证 —

累计安装 4

当前安装数 3

历史版本数 1

常见问题