Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to perform its stated Facebook Page posting function, but it needs review because it handles powerful long-lived Meta credentials with weak storage guidance and broad posting triggers.
Install only if you are comfortable giving the skill authority to publish or schedule Facebook Page content. Use a dedicated Meta app and Page token with the narrowest permissions possible, avoid storing the token and app secret in shell profiles or shared config files, keep credential files private, and rotate the token if it may have been exposed. Confirm the target platform before approving any post.
references/token-setup-guide.md:30Sensitive Meta credentials are transmitted in query strings and stored in plaintext configuration
references/token-setup-guide.md:20The Skill requests a Page engagement permission that is not used by its implementation
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Facebook Page Access Token Setup
## Prerequisites
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Symptom | Fix |
|---|---|
| Invalid OAuth access token | Re-generate token (Steps 2-3) |
| Requires pages_manage_posts | Re-authorize with correct permissions |
| Application does not have permission | Add yourself as tester in App Settings or switch to Live mode |
| Empty /me/accounts response | Re-authorize with `pages_show_list` |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* node fb-post.js --type text --message "Post" --schedule "2025-12-25T10:00:00+0800"
*
* Env vars required:
* LONG_META_page_TOKEN — Long-lived Page Access Token
* META_PAGE_ID — Facebook Page ID
* META_APP_SECRET — Meta App Secret (for appsecret_proof)
*/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* node fb-post.js --type text --message "Post" --schedule "2025-12-25T10:00:00+0800"
*
* Env vars required:
* LONG_META_page_TOKEN — Long-lived Page Access Token
* META_PAGE_ID — Facebook Page ID
* META_APP_SECRET — Meta App Secret (for appsecret_proof)
*/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* node fb-post.js --type text --message "Post" --schedule "2025-12-25T10:00:00+0800"
*
* Env vars required:
* LONG_META_page_TOKEN — Long-lived Page Access Token
* META_PAGE_ID — Facebook Page ID
* META_APP_SECRET — Meta App Secret (for appsecret_proof)
*/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* node fb-post.js --type text --message "Post" --schedule "2025-12-25T10:00:00+0800"
*
* Env vars required:
* LONG_META_page_TOKEN — Long-lived Page Access Token
* META_PAGE_ID — Facebook Page ID
* META_APP_SECRET — Meta App Secret (for appsecret_proof)
*/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* node fb-post.js --type text --message "Post" --schedule "2025-12-25T10:00:00+0800"
*
* Env vars required:
* LONG_META_page_TOKEN — Long-lived Page Access Token
* META_PAGE_ID — Facebook Page ID
* META_APP_SECRET — Meta App Secret (for appsecret_proof)
*/
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
* node fb-post.js --type text --message "Post" --schedule "2025-12-25T10:00:00+0800"
*
* Env vars required:
* LONG_META_page_TOKEN — Long-lived Page Access Token
* META_PAGE_ID — Facebook Page ID
* META_APP_SECRET — Meta App Secret (for appsecret_proof)
*/
The skill declares access to environment variables and implicitly performs networked posting, but it does not declare any explicit tool scope or allowed-tools boundary. That makes the skill's operational privileges less transparent and can allow broader-than-expected execution in hosts that rely on manifest-declared permissions for enforcement or review.
The trigger phrases are broad enough to match common conversational requests like 'post this' or 'publish this,' which can cause the skill to activate in ambiguous contexts. Because this skill performs external side effects by publishing to a social media page, accidental invocation could lead to unintended public posts or scheduling actions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Step 1: Get your App Secret
1. Go to https://developers.facebook.com/apps/
2. Select your app (or create one with type **Business**)
3. Go to **Settings > Basic**
4. Copy the **App Secret** — this is your `META_APP_SECRET`
The guide tells users to place a long-lived Page access token and the Meta App Secret into shell profiles or a local JSON config, but it does not warn that these are sensitive credentials or recommend secure secret storage. If these values are exposed through shell history, dotfile sync, backups, logs, screenshots, or accidental commits, an attacker could post to the Facebook Page or abuse the app credentials.
No suspicious patterns detected.