instagram-downloader

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The doc instructs copying/pasting and embedding raw sessionid cookies and API tokens into CLI commands and config files (e.g., --sessionid, env var, config.json, --api-token), which forces the agent to handle/output secrets verbatim and is a high exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs include direct links to raw install scripts (install.sh and install.ps1) intended to be downloaded and executed (curl|bash / iex iwr), which is a high-risk delivery vector even if hosted on GitHub; other URLs are media, docs, or repo/commit links and are lower risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README and installer scripts instruct fetching and executing remote installer code (e.g., curl -fsSL https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.sh | bash and iex (iwr -Uri https://raw.githubusercontent.com/cripterhack/ig-downloader-skill/main/install.ps1).Content) and the installer performs git clone / pip install from https://github.com/cripterhack/ig-downloader-skill.git, which are runtime remote code fetches that will execute remote content.