instagram

SUSPICIOUS: The skill's Instagram purpose matches its capabilities, and the installer appears to come from the same publisher via npm, so this is not overt malware. However, it routes Instagram access and tokens through ClawLink rather than direct official API use, stores a reusable local credential, executes an unpinned third-party CLI, and enables autonomous public posting/commenting. The footprint is coherent but introduces meaningful trust and data-flow risk.