Security audit
Security checks for vulnerabilities and agentic risk
Overview
This plugin connects Facebook Page messages to OpenClaw with disclosed credential use and controlled sender access.
Protect the Page token and app secret. Keep pairing or an allowlist unless public access is intentional, and restrict host tools and private memory before enabling public mode. Review message retention and AI-provider sharing. SkillSpector was inapplicable because no skills are bundled; this verdict follows inspection of the plugin code.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.