Security audit

Facebook Marketplace

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Facebook Marketplace guidance skill with local note-taking and user-approved Meta interactions, not hidden automation or unsafe execution.

Install only if you want Marketplace help that may remember local buying, selling, pricing, scam, and account-health context on your machine. Decline persistence or use stateless mode if you do not want those notes saved, and approve live Facebook or Messenger actions only when you are comfortable sending that listing or message data to Meta.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
This skill NEVER: - guarantees a sale, a deal, shipping eligibility, or policy outcomes - claims unsupported API or CLI access exists for consumer Marketplace actions - helps bypass restrictions, impersonate users, or move risky flows off platform ## Related Skills Install with `clawhub install <slug>` if user confirms:

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
This skill NEVER: - guarantees a sale, a deal, shipping eligibility, or policy outcomes - claims unsupported API or CLI access exists for consumer Marketplace actions - helps bypass restrictions, impersonate users, or move risky flows off platform ## Related Skills Install with `clawhub install <slug>` if user confirms:

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
 ## Messaging Defaults  ## Shipping and Protection

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · memory-template.md (reported line 22)May include surrounding context.
md
 ## Messaging Defaults  ## Shipping and Protection

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The phrase "Use this when the user is buying, scouting, or comparing listings" is a general activation condition without clear boundaries or exclusion cases. Terms like "buying" and "comparing listings" are broad enough to match many ordinary marketplace conversations, which could cause unintended skill invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template directs creation of persistent local files containing sensitive operational and incident data such as scam patterns, warning history, payment boundaries, and dispute notes, but provides no privacy warning, minimization guidance, or retention controls. In a marketplace context, this can lead to unnecessary storage of transaction-related personal information and security-relevant notes that could expose the user if the device, account, or workspace is accessed by others.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The phrase "Use this when the user hits removals, warnings, suspicious buyer or seller behavior, or feature confusion" mixes specific conditions with the vague catch-all "feature confusion." That term is underspecified and could overlap with many ordinary support requests, making activation boundaries unclear.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The setup instructions define activation boundaries in a way that is intentionally broad and proactive, allowing the skill to insert itself into many common conversations involving buying, selling, scams, or local transactions. This can cause over-activation, unnecessary collection of user context, and bypass of user intent boundaries, especially because the skill is also instructed to ask about persistence and maintain durable Marketplace context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.