instagram

SUSPICIOUS: The skill’s overall scope is coherent for Instagram management, but it introduces a third-party Imgur hop for publishing media and leaves dependency trust unresolved because requirements.txt is absent. No evidence of overt credential theft or hidden execution was provided, but the data flow is not fully aligned with a pure Meta Graph API integration and public-post/DM capabilities carry meaningful operational risk.

The code is consistent with a legitimate Instagram Graph API OAuth client and contains no clear malware or supply-chain backdoor behavior. It handles highly sensitive OAuth credentials and tokens, but the visible implementation lacks encryption details, sends secrets in GET query parameters, and omits OAuth state validation. The refresh timeout behavior and misleading remote-revocation description also warrant review. Database implementation and configuration values are not provided, so credential protection and endpoint authenticity cannot be fully assessed.

No direct malicious behavior is demonstrated because the fragment contains only database schema definitions and example SELECT queries. The dominant risk is security design: it stores Meta access tokens and app secrets (high-value credentials) and persists raw external API payloads and arbitrary action log JSON, which can materially increase exposure and the blast radius of any database/log compromise. Additional application code would be needed to confirm whether any exfiltration or unsafe handling occurs during runtime.