← 返回 Skills 市场

Instagram Reel Downloader (WhatsApp)

Name: Instagram Reel Downloader (WhatsApp)
Author: besaif

作者 Saif · GitHub ↗ · v1.0.1

cross-platform ⚠ suspicious

854

总下载

当前安装

版本数

在 OpenClaw 中安装

/install instagram-reel-downloader-whatsapp

功能描述

Download an Instagram Reel via sssinstagram.com and return it as a WhatsApp-ready video file. Use when a reel URL is provided and yt-dlp is blocked or not pr...

使用说明 (SKILL.md)

Instagram Reel via sssinstagram

Requirements

Node.js 18+.
playwright-core installed in the runtime.
Chromium-compatible browser binary available via:
- BROWSER_EXECUTABLE_PATH (preferred), or
- default /usr/bin/brave-browser.

Environment variables

OPENCLAW_WORKSPACE (optional): workspace root used for output path.
REEL_DOWNLOAD_DIR (optional): explicit download directory override.
BROWSER_EXECUTABLE_PATH (optional): browser binary path override.

Validate input URL.
- Accept only https://www.instagram.com/reel/... (or /reels/...) links.
Run downloader automation script.
- Execute:
  - node scripts/download_via_sss.mjs "\x3Cinstagram-url>"
- On success it prints:
  - MEDIA_PATH=\x3Cabsolute path>
Send the file to user on WhatsApp.
- Use message action=send with media set to MEDIA_PATH.
- Add a small caption like Done 🐾.
If the site blocks automation.
- Retry once after a short wait.
- If it still fails, report failure cleanly and ask user for another link.

Notes

Uses BROWSER_EXECUTABLE_PATH if set, otherwise defaults to /usr/bin/brave-browser.
Saves videos to REEL_DOWNLOAD_DIR when set, else \x3Cworkspace>/downloads (OPENCLAW_WORKSPACE or current working directory).
Uses Playwright (playwright-core) in headless mode.
Optional cleanup script: bash scripts/cleanup_reels.sh 30 (minutes to retain, default 30).
For user privacy, do not store links longer than needed for the download run.

安全使用建议

This skill behaves as described: it runs a headless browser (Playwright) to use sssinstagram.com and downloads the video file to a downloads folder. Before installing, ensure you have Node 18+, playwright-core installed in the runtime, and a Chromium-compatible binary available (set BROWSER_EXECUTABLE_PATH if the default path is wrong). Be aware the skill contacts a third-party downloader site (sssinstagram.com) and downloads media from URLs that site returns — if that site is compromised or malicious it could cause you to fetch unexpected content. The skill does not request secrets, but it will write files to the workspace; consider running it in an isolated environment and periodically running the provided cleanup script. If you don't want the agent to run this autonomously, disable or restrict autonomous invocation on the platform side.

功能分析

Type: OpenClaw Skill Name: instagram-reel-downloader-whatsapp Version: 1.0.1 The skill is suspicious due to a significant vulnerability related to the `BROWSER_EXECUTABLE_PATH` environment variable, which, if controlled by an attacker, could lead to Remote Code Execution (RCE) by launching an arbitrary executable instead of a browser (found in `SKILL.md` and `scripts/download_via_sss.mjs`). Additionally, the `REEL_DOWNLOAD_DIR` environment variable allows an attacker to specify an arbitrary download location, and the `download_via_sss.mjs` script runs Chromium with `--no-sandbox`, reducing its security posture. While these are vulnerabilities that could be exploited, there is no clear evidence of intentional malicious behavior by the skill itself.

能力评估

✓ Purpose & Capability

Name/description match the included files: the Node script uses Playwright to open sssinstagram.com, submit an Instagram reel URL, and save a video file. Required runtime pieces (Node 18+, playwright-core, Chromium-compatible binary) are reasonable and documented in SKILL.md.

ℹ Instruction Scope

Runtime instructions and script are narrowly scoped to validating an Instagram reel URL, visiting sssinstagram.com, locating download links/buttons, and saving a video to a downloads folder. Note: the script performs network requests to sssinstagram.com and then downloads whichever hrefs that site exposes (CDNs or direct video links). This is expected for the task but means the skill will fetch content from third-party hosts returned by the downloader site.

✓ Install Mechanism

No install spec bundled; the skill is instruction + code only. It relies on runtime presence of Node, playwright-core, and a browser binary. There are no embedded downloads, URL installs, or extraction of remote archives in the skill bundle itself.

✓ Credentials

No sensitive credentials requested. Only optional env vars (OPENCLAW_WORKSPACE, REEL_DOWNLOAD_DIR, BROWSER_EXECUTABLE_PATH) are used and are proportional to file placement and browser selection.

✓ Persistence & Privilege

always is false and the skill doesn't modify other skills or system-wide configs. It writes downloaded media to a workspace downloads directory (configurable) and provides a cleanup script. Autonomous invocation is enabled by default (platform default) but not excessive here.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install instagram-reel-downloader-whatsapp
安装完成后，直接呼叫该 Skill 的名称或使用 /instagram-reel-downloader-whatsapp 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.1

Security/docs hardening: explicit requirements, env var consistency, portable cleanup/output path controls.

v1.0.0

Initial public release: browser-based Instagram Reel download via sssinstagram with WhatsApp-ready media output.

元数据

Slug instagram-reel-downloader-whatsapp

版本 1.0.1

许可证 —

累计安装 1

当前安装数 0

历史版本数 2

常见问题