Integrates with the Instagram Graph API to fetch and publish media, enabling effective social media management.
Install this skill
Security score
The instagram skill was audited on Feb 12, 2026 and we found 23 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 76 | ```bash |
Template literal with variable interpolation in command context
| 97 | ```bash |
Template literal with variable interpolation in command context
| 113 | ```bash |
Template literal with variable interpolation in command context
| 123 | ```bash |
Template literal with variable interpolation in command context
| 149 | ```bash |
Template literal with variable interpolation in command context
| 175 | ```bash |
Curl to non-GitHub URL
| 60 | > bash -c 'curl -s "https://api.example.com" -H "Authorization: Bearer $API_KEY"' | jq '.' |
Curl to non-GitHub URL
| 77 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/${INSTAGRAM_BUSINESS_ACCOUNT_ID}/media?fields=id,caption,media_type,media_url,permalink,timestamp" --header "Authorization: Bearer ${INSTAGRAM |
Curl to non-GitHub URL
| 98 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/<your-media-id>?fields=id,caption,media_type,media_url,permalink,thumbnail_url,timestamp,username" --header "Authorization: Bearer ${INSTAGRAM |
Curl to non-GitHub URL
| 114 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/ig_hashtag_search?user_id=${INSTAGRAM_BUSINESS_ACCOUNT_ID}&q=<hashtag-name>" --header "Authorization: Bearer ${INSTAGRAM_ACCESS_TOKEN}"' |
Curl to non-GitHub URL
| 124 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/<hashtag-id>/recent_media?user_id=${INSTAGRAM_BUSINESS_ACCOUNT_ID}&fields=id,caption,media_type,media_url,permalink,timestamp" --header "Autho |
Curl to non-GitHub URL
| 150 | bash -c 'curl -s -X POST "https://graph.facebook.com/v21.0/${INSTAGRAM_BUSINESS_ACCOUNT_ID}/media" -H "Content-Type: application/json" -d @/tmp/request.json --header "Authorization: Bearer ${INSTAGRAM |
Curl to non-GitHub URL
| 176 | bash -c 'curl -s -X POST "https://graph.facebook.com/v21.0/${INSTAGRAM_BUSINESS_ACCOUNT_ID}/media_publish" -H "Content-Type: application/json" -d @/tmp/request.json --header "Authorization: Bearer ${I |
External URL reference
| 14 | > Official docs: `https://developers.facebook.com/docs/instagram-api` |
External URL reference
| 60 | > bash -c 'curl -s "https://api.example.com" -H "Authorization: Bearer $API_KEY"' | jq '.' |
External URL reference
| 77 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/${INSTAGRAM_BUSINESS_ACCOUNT_ID}/media?fields=id,caption,media_type,media_url,permalink,timestamp" --header "Authorization: Bearer ${INSTAGRAM |
External URL reference
| 98 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/<your-media-id>?fields=id,caption,media_type,media_url,permalink,thumbnail_url,timestamp,username" --header "Authorization: Bearer ${INSTAGRAM |
External URL reference
| 114 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/ig_hashtag_search?user_id=${INSTAGRAM_BUSINESS_ACCOUNT_ID}&q=<hashtag-name>" --header "Authorization: Bearer ${INSTAGRAM_ACCESS_TOKEN}"' |
External URL reference
| 124 | bash -c 'curl -s -X GET "https://graph.facebook.com/v21.0/<hashtag-id>/recent_media?user_id=${INSTAGRAM_BUSINESS_ACCOUNT_ID}&fields=id,caption,media_type,media_url,permalink,timestamp" --header "Autho |
External URL reference
| 142 | "image_url": "https://example.com/image.jpg", |
External URL reference
| 147 | Replace `https://example.com/image.jpg` with any publicly accessible image URL and update the caption text as needed. |
External URL reference
| 150 | bash -c 'curl -s -X POST "https://graph.facebook.com/v21.0/${INSTAGRAM_BUSINESS_ACCOUNT_ID}/media" -H "Content-Type: application/json" -d @/tmp/request.json --header "Authorization: Bearer ${INSTAGRAM |
External URL reference
| 176 | bash -c 'curl -s -X POST "https://graph.facebook.com/v21.0/${INSTAGRAM_BUSINESS_ACCOUNT_ID}/media_publish" -H "Content-Type: application/json" -d @/tmp/request.json --header "Authorization: Bearer ${I |