ClawHub
Back to skill

Security audit

fb_page_manager

Security checks across malware telemetry and agentic risk

Overview

This skill transparently helps publish confirmed posts to a Facebook Page, but users must protect the Meta credentials and review posts carefully before approving them.

Install only if you want an agent to draft and publish to the configured Facebook Page. Confirm the destination Page, text, image, link, and schedule before approving any post. Store the Page token and App Secret securely, do not commit them to repositories or logs, restrict local config access, and rotate or revoke the token if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill requires sensitive environment variables and network access to publish to Facebook, but it does not declare explicit permissions for those capabilities. This weakens security review and user/admin visibility into what the skill can access, making it easier for a high-impact posting capability to be enabled without clear consent boundaries.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger phrases include broad terms like "post this," "publish this," and general multilingual social-posting phrases that may match ordinary conversation without sufficiently confirming user intent or target account. In a skill that can publish externally to a public Facebook Page, accidental invocation can cause unauthorized or reputationally damaging posts.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The guide instructs users to place a Facebook Page token and App Secret directly into shell profiles or a JSON config file without any warning about secure storage, file permissions, redaction, or secret leakage. In an agent skill context, these credentials enable posting to a Facebook Page and could be exposed through logs, screenshots, backups, repo commits, or other local users if handled insecurely.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.