instagram

Security Findings (13)

• HighRug-Pull (Post-Install Description Change)

  Tool set changed silently at vsmithery: 16 tool(s) added, 22 tool(s) removed without a version bump.

  + 16 added

  INSTAGRAM_CREATE_CAROUSEL_CONTAINERINSTAGRAM_CREATE_MEDIA_CONTAINERINSTAGRAM_CREATE_POSTINSTAGRAM_GET_CONVERSATIONINSTAGRAM_GET_POST_COMMENTSINSTAGRAM_GET_POST_INSIGHTSINSTAGRAM_GET_POST_STATUSINSTAGRAM_GET_USER_INFOINSTAGRAM_GET_USER_INSIGHTSINSTAGRAM_GET_USER_MEDIAINSTAGRAM_LIST_ALL_CONVERSATIONSINSTAGRAM_LIST_ALL_MESSAGESINSTAGRAM_MARK_SEENINSTAGRAM_REPLY_TO_COMMENTINSTAGRAM_SEND_IMAGEINSTAGRAM_SEND_TEXT_MESSAGE

  − 22 removed

  ig_delete_commentig_get_accountig_get_account_insightsig_get_childrenig_get_commentig_get_hashtag_recentig_get_hashtag_topig_get_mediaig_get_media_insightsig_get_mentioned_mediaig_get_story_insightsig_hide_commentig_list_commentsig_list_mediaig_list_storiesig_list_tagsig_publish_carouselig_publish_photoig_publish_reelig_publish_storyig_reply_commentig_search_hashtag

  Rule: AS-012Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.
• HighExcessive Permission Surface ×3

  • INSTAGRAM_CREATE_CAROUSEL_CONTAINER:tool declares network permission
  • INSTAGRAM_CREATE_MEDIA_CONTAINER:tool declares network permission
  • INSTAGRAM_SEND_IMAGE:tool declares network permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• MediumExcessive Permission Surface ×5

  • INSTAGRAM_CREATE_CAROUSEL_CONTAINER:tool declares fs permission
  • INSTAGRAM_CREATE_MEDIA_CONTAINER:tool declares fs permission
  • INSTAGRAM_CREATE_POST:tool declares fs permission
  • INSTAGRAM_GET_USER_INFO:tool declares fs permission
  • INSTAGRAM_GET_USER_INSIGHTS:tool declares fs permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• LowDoS Resilience — Missing Rate Limit / Timeout ×3

  • INSTAGRAM_CREATE_CAROUSEL_CONTAINER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • INSTAGRAM_CREATE_MEDIA_CONTAINER:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • INSTAGRAM_SEND_IMAGE:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  Rule: AS-011Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.
• LowExcessive Permission Surface

  INSTAGRAM_CREATE_MEDIA_CONTAINER:input schema exposes 11 properties (threshold: 10)

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.