instagram-downloader

No explicit malware behavior is visible in this installer script fragment (no secrets, no exfiltration, no persistence logic). The dominant concern is supply-chain execution risk: it clones and installs Python code/dependencies from remote sources without pinning to a commit/tag or verifying integrity, and it uses Invoke-Expression to execute pip install commands. While this more likely reflects a convenience installer than a malicious payload, it should be treated as a potentially dangerous installer in threat modeling and should be reviewed/mitigated via pinning and integrity verification.

This installer script shows no clear signs of overt malware in the provided fragment (no backdoor/persistence, no exfiltration logic, no credential harvesting). However, it has meaningful supply-chain risk: in standalone mode it clones a mutable GitHub repo without commit/tag pinning and then installs the package (and dependencies, including Playwright) via pip without version pinning or integrity verification. It also suppresses pip stderr during installs, reducing observability. In a threat model that includes upstream compromise or dependency tampering, the code should be treated as higher-risk and should be reviewed/pinned/verified before use.

SUSPICIOUS: the core behavior matches an Instagram downloader, but the footprint is high-risk for a skill because it harvests browser cookies, stores a reusable sessionid locally, and can route data through Apify. Install trust is relatively normal, so this is not confirmed malware, but credential handling and TLS-bypass options make it a medium-to-high security risk.