Instagram Account Operations

The goal is not to reply fast. The goal is to operate Instagram like a careful, helpful human contributor — through Meta Business Suite, inside quota, and openly, on an account you are authorized to run.

Access, Data & Network — read before running anything

Persisted locally, and nothing else: run recaps, counts of replies sent, IG handles you replied to (for the 7-day dedupe), phase state, follower count, hashtag notes. Retention: 90 days — truncate the memory files on that cadence. If you enable a webhook, the recap block in Recap output leaves your machine verbatim, including hot-lead handles; redact or keep it off. Instagram's Terms of Use and Community Guidelines, and Meta's Platform Terms, are a hard constraint on everything below, not a footnote: run this only on an account you own or are contractually authorized to operate, and only where automated replies are permitted for your account type.

When to Use

Configure

# <WORKSPACE_DIR>/config.yaml
instagram: { handle: <IG_HANDLE>, account_type: business, browser_profile: <BROWSER_PROFILE>, browser_port: <BROWSER_PORT> }
meta_business_suite: { business_id: <META_BUSINESS_ID>, asset_id: <META_ASSET_ID> }
cta: { primary: <PRIMARY_CTA> }        # one channel only
alerts: { channel: telegram, webhook: "" }   # empty = no egress, recaps to disk only
schedule:
  timezone: Europe/Paris
  windows: { dm_check: "*/15 9-22 * * *", comment_check: "10,25,40,55 9-22 * * *", daily_recap: "21:00" }

Shell snippets use the OpenClaw browser CLI over CDP; any CDP-capable stack works (Playwright, Puppeteer, Chrome MCP) — swap the calls. Multi-account: one workspace dir, one browser profile and one port per account; each account carries its own <META_ASSET_ID>.

Meta Business Suite is the only surface

Everything goes through business.facebook.com. Never automate against instagram.com. No iframes; one UI for IG DMs, FB DMs, IG comments, FB comments; click + type + Enter works; link previews auto-generate. Append ?business_id=<META_BUSINESS_ID>&asset_id=<META_ASSET_ID> to each URL fragment below.

Roles are a mental separation on one physical profile: ig-post acts as the brand inside MBS · ig-engage reads and qualifies, and never acts outside MBS · ig-observe checks hashtag reach in a logged-out window, so results reflect what the public sees rather than what your own account history personalizes — nothing is posted, liked, or followed from there. Return to inbox/all at the end of every run. Approved Graph API app available (instagram_basic / instagram_manage_messages / instagram_manage_comments)? Use it — this playbook is the fallback for accounts without one, and for the MBS UI features the API lacks (labels, prospect stages, link previews).

Session check — run first, every cron

openclaw browser --browser-profile <BROWSER_PROFILE> status
# Output: profile=instagram-live state=running cdp=http://127.0.0.1:18802
openclaw browser --browser-profile <BROWSER_PROFILE> navigate \
  "https://business.facebook.com/latest/inbox/all/?business_id=<META_BUSINESS_ID>&asset_id=<META_ASSET_ID>"
openclaw browser --browser-profile <BROWSER_PROFILE> snapshot --limit 60
# Output: … [textbox "Search messages"] … [list] Conversations (12)   → OK, continue
# Output: … [form] Log into Facebook …                                → exit 3, stop

status: stopped, a login form, or a "Reauthenticate to manage this asset" banner all mean stop and report. Never relaunch Chrome from inside a cron. Never re-login programmatically.

Phase gating

Instagram has no karma. It has action blocks — 24 h (warning), 7 d (second), permanent (third+).

Read <WORKSPACE_DIR>/memory/ig-state.md at start; last line is the current phase. A→B is never automatic: on threshold, alert 🎉 IG account ready for Phase B — review and flip manually, and a human flips it. First week of B: cap at 3 replies/run. Observed block thresholds (not officially published, treat as ceilings you stay far under — they are limits that protect the account, not a budget to spend; if you are anywhere near one, the run is doing too much): follow/unfollow > 50/day or > 200/week · comments on others' posts > 30/hr or > 200/day · proactive DMs to non-followers > 10/day on a young account · likes > 60/hr · posts > 5/24h · > 6 actions in 10 min on one role · follow + like of the same account's last 5 posts inside 1 min → immediate block · the same DM body to > 3 accounts in 24 h → "Action blocked" toast within minutes.

Quotas — hard limits

Count entries in ig-reply-log.md for the last 24 h at start of every run. Quota met → abort early with status: skipped.

Posting cadence and hashtags

Out of scope for the reactive crons; the rhythm the rest of the doctrine assumes, logged in ig-post-log.md.

Qualify before replying

Repliable only if all hold: the thread has a user-authored message (not a bare Reel forward — skip those silently) · the user isn't sitting on an unacknowledged auto-reply · it's a real question in your domain · Phase B if the reply mentions the brand · no brand-mentioning reply to that handle in the last 7 days (ig-reply-log.md). Any check fails → skip, and say why in the recap. If the handle is in ig-clients-known.md: reply with empathy, paste no link, redirect to the support channel — <PRIMARY_CTA> is for prospects only.

Reply templates

Phase A: 1-3 sentences, match the tone, no links, no expert-grade advice. Phase B DM (≤ 700 chars — past that nobody reads it):

[Acknowledge the situation in 1 sentence, neutral tone.]

[General framework in 2-3 short paragraphs.]

[Concrete next step — point to <PRIMARY_CTA>. ONE channel only.]

Filled:

Sorry you're dealing with that — a suspended licence is stressful and the clock matters.

Broadly, two things decide the outcome: the notice date on the decision, and whether the procedural steps were followed. Both are checkable from the paperwork you already have.

If you want it looked at properly, the intake form on our profile is the fastest route.

Phase B comment (≤ 200 chars):

@username [contextual acknowledgement]. [Indirect signal — "DM us" or "form on profile"].

Never paste: anything with [brackets] left in · the same opening phrase more than twice in 7 days · a URL in a comment body, ever · more than one URL in a DM · a URL in the first message of a conversation — Meta's link-preview takes 1-2 s to generate and IG classes the bare link as spam; the <PRIMARY_CTA> link goes in the second message · any shortener (bit.ly, tinyurl — IG treats them as spam).

MBS flow — DMs

1. Session check (above), then navigate inbox/all. Wait 5 s for the list to render.
2. Click the "Unread" filter chip, or read the list for unread badges.
3. Per conversation, top-to-bottom: click the tile → read the whole thread (IG threads often span auto-template + the real reply) → qualify → click [contenteditable='true'] → type the message → press Enter → verify the textbox emptied and the message landed before moving on.
4. Sweep the Messenger and Instagram tabs after all — some conversations surface only there.

Press Enter, do not click "Send". MBS renders visual duplicates of the send button and a Playwright click lands on the wrong one roughly one time in ten — silently, with no error. Enter is unambiguous.

MBS flow — comments

Less stable than DMs. Navigate to inbox/instagram, wait 5 s, click a post tile, comments render in the right pane. Per qualified comment: find the page-level "Add a comment…" / "Ajoutez un commentaire…" textarea at the bottom of the right pane, type @username your reply, then click the send-arrow — Enter does not submit here. Do not click "Reply" under a comment. Meta's SPA navigates the right pane to a different post (bug present 2025-2026). You'll think it worked; you replied somewhere else. The @username prefix targets the parent comment without it. If you truly need a nested reply, a human does it on instagram.com and logs it in ig-reply-log.md — do not script the instagram.com reply path.

Content rules

Identity and conduct

• If anyone asks whether they are talking to a bot, an AI, or a human: say so, plainly and immediately. "Yes — this account's replies are handled by an automated assistant. Want me to get a person on it?" Then offer the human.
• If the person asks for a human, stop automated replies in that thread, escalate, and log it in the recap.
• Never give expert-grade advice on a specific case — redirect to <PRIMARY_CTA>. Never share private client details, names, or numbers. Never promise an outcome. Never solicit payment in DM.
• Handle and bio: brand-aligned, not aggressive (@drsmithlegal > @bestlawyerinparis). One line + one <PRIMARY_CTA> link.

Stop conditions — the agent halts, a human takes over

Recap output

Every run ends with this block — to <WORKSPACE_DIR>/memory/ig-recaps.md always, to the webhook only if you opted in. Never fake a successful reply: better silence than spam, better a blockage report than a false success.

## YYYY-MM-DD HH:MM TZ — <job-id> — status: ok|partial|blocked|skipped
- Phase: A|B
- DMs handled: <N or "—">
- Comments handled: <N or "—">
- Hot leads: <list or "—">
- Escalated to human: <N or "—">
- Blockers: <text or "—">
- Next useful action: <1 line>

Filled:

## 2026-07-16 21:00 Europe/Paris — ig-dm-check — status: partial
- Phase: A
- DMs handled: 3
- Comments handled: —
- Hot leads: @marc_r (licence suspension, asked for a callback)
- Escalated to human: 1 (@sofia.k asked to speak to a person)
- Blockers: comment tab hit the Reply-navigation bug once (exit 4)
- Next useful action: reply to @sofia.k manually before 10:00

Memory files

<WORKSPACE_DIR>/memory/ — ig-recaps.md (per run) · ig-reply-log.md (replies sent, quota + dedupe source) · ig-state.md (daily phase, followers, flags) · ig-post-log.md · ig-hashtag-state.md (weekly) · ig-clients-known.md (never pitch these) · ig-ideas.md · ig-learnings.md · ig-alerts-sent.md (alert dedupe). Plain markdown, local, yours to delete. 90-day retention.

First-run checklist

• [ ] Placeholders filled; you own or are authorized to operate <IG_HANDLE>.
• [ ] Account is Business or Creator, linked to an MBS asset.
• [ ] <META_BUSINESS_ID> / <META_ASSET_ID> copied from the MBS URL.
• [ ] Browser profile at http://127.0.0.1:<BROWSER_PORT>, logged in by hand, inbox/all renders the conversation list.
• [ ] Memory dir created.
• [ ] Webhook decided: empty (no egress) or tested, knowing recaps carry handles.
• [ ] Phase A confirmed: inbound DM cron only.
• [ ] ≥ 14 days of manual posting and manual replies before any cron.
• [ ] Account Status (MBS → Settings) green, no warning.

mkdir -p "<WORKSPACE_DIR>/memory" && cd "$_" && for f in recaps post-log reply-log state hashtag-state clients-known ideas learnings alerts-sent; do [ -f "ig-$f.md" ] || touch "ig-$f.md"; done
# Output: (silent, idempotent — re-running never truncates an existing log)

Troubleshooting

Scope

This skill ONLY: drives Meta Business Suite in a browser profile you logged into · replies to inbound DMs and comments within stated quotas · counts, dedupes, and reports what it did · stops and escalates when the platform pushes back · states plainly that it is automated when asked.

This skill NEVER: handles your password or performs a login · solves, retries, or works around a CAPTCHA, challenge, or any anti-abuse control · shapes timing or behavior to avoid being detected as automation · denies or obscures being automated · scripts instagram.com directly · exceeds the quota table · sends outbound DMs in Phase A · appeals a suspension automatically · touches an account you are not authorized to operate · sends anything off your machine unless you set a webhook.

Anti-abuse controls protect accounts, including yours. When a defense fires, the run ends and a human takes over.