SocialKit Facebook Post

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 7:00 AM UTC
• Version: 0.3.1

Overview

The skill publishes approved Facebook Page posts with appropriate controls, though its shared setup guide includes unnecessary instructions for other platforms.

Use only Facebook setup and permissions for this task; skip the unrelated Instagram and Threads instructions. Review the separate authentication and core skills, protect stored tokens, and confirm the Page, content, media, and schedule before approving. Those dependencies and live API behavior were not tested.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Facebook authentication is a supporting implementation detail consistent with the declared purpose. Threads authentication extends setup to a separate, undeclared platform and is inconsistent with the explicit Facebook Pages-only scope. The supplied chunk does not show the authentication script's internals or any publishing behavior.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

3. Validate: `node scripts/publish.mjs --check --dir fb-<slug>`

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

5. Publish: `node scripts/publish.mjs --publish --dir fb-<slug>`. Report the post id,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 29)May include surrounding context.

md

1. https://developers.facebook.com/apps > Create app > type **Business**.
2. Add **Facebook Login for Business**. Under its settings add your redirect URL to
   **Valid OAuth Redirect URIs** (exact match, Strict Mode on).
3. Optional but recommended: create a Login configuration (User access token) with the
   permissions below, and set its ID as `META_LOGIN_CONFIG_ID`. Without it the auth script
   requests the permissions by scope.
4. Permissions used: `pages_show_list`, `pages_read_engagement`, `pages_manage_posts`,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish.mjs (reported line 553)May include surrounding context.

js

function defaultHint(error) {
  switch (error.code) {
    case 190:
      return "The access token is expired or invalid. Re-run the auth script for this platform.";
    case 4:
    case 17:
    case 32:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.