Security audit
Security checks for vulnerabilities and agentic risk
This skill previews a future Facebook integration and offers an optional waitlist signup that requires your explicit permission.
Installing this skill does not enable Facebook actions. If you join the waitlist, Agiexa receives the details you confirm; omit the optional URL and message if you prefer. The separate future integration's security assurances are claims in the documentation, not guarantees established by this package.
The supplied code performs only a waitlist submission. It does not publish posts, manage comments, retrieve insights, or implement the advertised Facebook tools. Although the endpoint belongs to the declared integration provider, waitlist enrollment is a materially different purpose rather than a supporting implementation detail of the advertised operations.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| `FACEBOOK_GET_COMMENT` | Retrieves details of a specific Facebook comment |
| `FACEBOOK_GET_COMMENTS` | Retrieves comments from a Facebook post or comment (for replies) |
| `FACEBOOK_GET_CONVERSATION_MESSAGES` | Retrieves messages from a specific conversation |
| `FACEBOOK_GET_CURRENT_USER` | Validates the access token and retrieves the authenticated user's own profile via /me |
| `FACEBOOK_GET_MESSAGE_DETAILS` | Retrieves details of a specific message sent or received by the Page |
| `FACEBOOK_GET_PAGE_CONVERSATIONS` | Retrieves a list of conversations between users and the Page |
| `FACEBOOK_GET_PAGE_DETAILS` | Fetches details about a specific Facebook Page |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| `FACEBOOK_GET_POST_INSIGHTS` | Retrieves analytics and insights for a specific Facebook post |
| `FACEBOOK_GET_SCHEDULED_POSTS` | Retrieves scheduled and unpublished posts for a Facebook Page |
| `FACEBOOK_LIKE_POST_OR_COMMENT` | Adds a LIKE reaction to a Facebook post or comment |
| `FACEBOOK_LIST_MANAGED_PAGES` | Retrieves a list of Facebook Pages that the user manages (not personal profiles), including page details, access tokens, and tasks |
| `FACEBOOK_MARK_MESSAGE_SEEN` | Marks a user's message as seen by the Page, visibly updating the read status in the user's conversation |
| `FACEBOOK_PUBLISH_SCHEDULED_POST` | Publishes a previously scheduled or unpublished Facebook post immediately |
| `FACEBOOK_REMOVE_PAGE_TASK` | Removes a user's tasks/access from a specific Facebook Page |
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
openclaw:
requires:
bins:
- curl
homepage: https://agiexa.com/integrations/facebook
---
The description at L003 presents publishing posts, handling comments, and checking insights as available capabilities. However, L070 directs the agent to explain that these capabilities are not yet available, and the supplied executable workflow posts user contact details to a launch waitlist rather than performing Facebook operations. Explicit consent limits the data-submission risk but does not resolve the mismatch with the advertised purpose.
L114 states that nothing about the user's store or conversation is sent. Yet L085 requests a Shopify store URL, and L095–L098 include that URL and a user-provided message in the outbound payload. Although these fields are optional and submission requires consent, the categorical privacy assurance contradicts the documented request.