Facebook Account Operations

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:24 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Facebook Page automation guide with real account-management risk, but no hidden code, exfiltration, or deceptive behavior was found.

Use this only for Facebook Pages you own or are authorized to manage. Review any cron jobs before enabling them, use a dedicated browser profile, keep workspace memory files and webhook alerts private, and require manual review before actions such as deleting comments, banning users, or expanding beyond Phase A.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

5. **Start in Phase A** until page_age ≥ 30 days AND followers ≥ 100 AND no warning in 30 days. Don't shortcut.

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Ae1

High

• Category: analysis-evasion

Content

| Cursor / Copilot CLI | drop `SKILL.md` into your project's `.cursorrules` or `AGENTS.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| Cursor / Copilot CLI | drop `SKILL.md` into your project's `.cursorrules` or `AGENTS.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

## 15. Phase A → Phase B transition

When the Daily Metrics Recap detects (page_age_days ≥ 30) AND (followers ≥ 100) AND (page_quality = green) AND (no warning in 30 d):

1. Append to `fb-state.md`: `YYYY-MM-DD - phase=A - PHASE_B_THRESHOLD_REACHED`.
2. Send a distinct alert: `🎉 FB Page ready for Phase B — flip outbound crons manually after review`.

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### Manual copy

```bash
mkdir -p ~/.claude/skills/facebook-account-operations
cp SKILL.md ~/.claude/skills/facebook-account-operations/
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Manual copy

```bash
mkdir -p ~/.claude/skills/facebook-account-operations
cp SKILL.md ~/.claude/skills/facebook-account-operations/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description is intentionally broad enough to activate on many generic Facebook-related tasks, including scheduled automation. In this context, that increases the chance an agent will apply high-risk account-automation behavior outside narrowly intended Page-management scenarios, which can cause unsafe actions or policy-violating automation on Facebook surfaces.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The configuration example sets `timezone: Europe/Paris`, which imposes a locale-specific default in natural language guidance/configuration. The file does not frame this as an example to be replaced based on user preference or operational locale, so it can violate language/locale policy expectations.

Static analysis

No suspicious patterns detected.