Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Facebook Reels search wrapper, but it relies on an external MCP and Chrome extension with logged-in Facebook access.
Install only if you trust Gecho Bridge and its Chrome extension. Prefer a pinned or reviewed version of the MCP package when possible, use a dedicated browser profile or account if privacy matters, and choose a secure save directory because outputs may contain social-media comments, links, and engagement data.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Join the [WeCom group](https://github.com/gecho-ai/gecho-bridge/blob/main/qywx.jpg) or use the [1:1 support QR code](https://github.com/gecho-ai/gecho-bridge/blob/main/wx.jpg).
## Output guidelines
Successful runs should:
The skill instructs users to install and run an MCP server via npx ... @latest, which fetches and executes the newest package version at runtime without pinning. This creates a supply-chain risk: a compromised upstream package, malicious publish, or breaking update could execute arbitrary code on the user's machine when they follow setup instructions.
The skill promotes saving structured Facebook Reels data locally but does not give a clear, prominent warning that saved outputs may contain comments, links, engagement data, or other potentially sensitive/restricted content. This can lead to unintentional retention or mishandling of scraped social-media data on disk, especially in shared or unmanaged environments.
No suspicious patterns detected.