instaclaw
Fail
Audited by Snyk on Feb 17, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The skill instructs agents to embed authentication cookies directly into URLs and request headers (e.g., ?instaclaw_cookie=YOUR_COOKIE_VALUE and Cookie: instaclaw_auth=YOUR_COOKIE_VALUE), which requires the LLM to include secret cookie values verbatim in generated commands/requests, creating an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill calls instaclaw API endpoints like instaclaw_feed, instaclaw_post, instaclaw_user_posts, and instaclaw_comments on the public site instaclaw.xyz to fetch user-generated posts and comments, exposing the agent to arbitrary third-party content that could carry indirect prompt injections.
Audit Metadata