Facebook Page
Analysis
This appears to be a legitimate Facebook Page API integration, but it can access OAuth-protected Page data and perform public or destructive Page actions if the user approves them.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
**All write operations require explicit user approval.** Before publishing posts, uploading photos, posting comments, or deleting content, confirm the target page, resource, and intended effect with the user.
The skill exposes write, publish, upload, comment, and delete operations against Facebook Pages. The approval instruction is a meaningful boundary, but users should notice that the available API actions can affect public Page content.
Source: unknown; Homepage: https://maton.ai
The registry metadata does not provide a source repository, while the skill relies on the Maton hosted API service. There is no local install or code dependency shown, so this is a provenance notice rather than a material supply-chain concern.
python <<'EOF'
import urllib.request, os, json
req = urllib.request.Request('https://api.maton.ai/facebook-page/v25.0/me/accounts?fields=id,name,category,fan_count,followers_count')The documentation includes user-run Python snippets that make HTTPS API requests. This is purpose-aligned for an instruction-only API skill and does not show hidden, automatic, or obfuscated execution.
**Publishing posts and comments are publicly visible.** Always confirm post content and target page with the user before publishing, as these actions are immediately visible to the page's audience.
A mistaken publish or comment action can propagate immediately to a public Page audience. The skill documents this and requires confirmation, reducing but not eliminating impact.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Access the Facebook Graph API with managed OAuth authentication. ... Authorization: Bearer $MATON_API_KEY
The skill requires a Maton API key and OAuth-backed access to a Facebook Page account. This is expected for the integration, but it gives the skill authority over connected Page resources.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Maton proxies requests to `graph.facebook.com` and automatically injects your OAuth token.
Requests flow through the Maton gateway to Facebook, and OAuth material is handled by that gateway. This is disclosed and purpose-aligned, but it means Page data and authorization context pass through a third-party provider.