Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only Facebook Page API skill whose token use and content-management actions are disclosed and aligned with its stated purpose.
Install only if you intend to let an agent help with Facebook Page publishing or moderation. Treat FB_APP_SECRET and FB_ACCESS_TOKEN as live credentials, prefer Authorization headers over query-string tokens, use the narrowest Page permissions possible, and confirm targets before deleting posts or comments.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## 4) Hide or delete a comment
- Hide: `POST /{comment-id}` with `is_hidden=true`
- Delete: `DELETE /{comment-id}`
## 5) Moderation workflow
- Validate comment text.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- HTTP GET for reads.
- HTTP POST for creates/updates.
- HTTP DELETE for deletes (where supported).
- Access token in query (`access_token`) or `Authorization: Bearer` header.
## 3) Page publishing flow (high level)
- Obtain user access token with required scopes.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# HTTP Request Templates (Graph API)
## Authentication
All requests must include a valid access token. You can pass it either:
- As a query parameter: `?access_token=YOUR_TOKEN`
- Or as an HTTP header: `Authorization: Bearer YOUR_TOKEN`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# HTTP Request Templates (Graph API)
## Authentication
All requests must include a valid access token. You can pass it either:
- As a query parameter: `?access_token=YOUR_TOKEN`
- Or as an HTTP header: `Authorization: Bearer YOUR_TOKEN`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# HTTP Request Templates (Graph API)
## Authentication
All requests must include a valid access token. You can pass it either:
- As a query parameter: `?access_token=YOUR_TOKEN`
- Or as an HTTP header: `Authorization: Bearer YOUR_TOKEN`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# HTTP Request Templates (Graph API)
## Authentication
All requests must include a valid access token. You can pass it either:
- As a query parameter: `?access_token=YOUR_TOKEN`
- Or as an HTTP header: `Authorization: Bearer YOUR_TOKEN`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# HTTP Request Templates (Graph API)
## Authentication
All requests must include a valid access token. You can pass it either:
- As a query parameter: `?access_token=YOUR_TOKEN`
- Or as an HTTP header: `Authorization: Bearer YOUR_TOKEN`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# HTTP Request Templates (Graph API)
## Authentication
All requests must include a valid access token. You can pass it either:
- As a query parameter: `?access_token=YOUR_TOKEN`
- Or as an HTTP header: `Authorization: Bearer YOUR_TOKEN`
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## 5) Update or delete
- Update post: `POST /{post-id}` (fields you want to change)
- Delete post: `DELETE /{post-id}`
## Notes
- Page access token required for publish actions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Permissions and Tokens
## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).
## 2) Common Page permissions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Permissions and Tokens
## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).
## 2) Common Page permissions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Permissions and Tokens
## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).
## 2) Common Page permissions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Permissions and Tokens
## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).
## 2) Common Page permissions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Permissions and Tokens
## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).
## 2) Common Page permissions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Permissions and Tokens
## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).
## 2) Common Page permissions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Permissions and Tokens
## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).
## 2) Common Page permissions
This markdown file documents a delete operation for comments but does not warn that deletion may be irreversible or affect user data. For markdown files, safety-impacting behaviors should include clear disclosure when they can modify or remove content.
This markdown file documents moderation and deletion operations such as hiding and deleting comments, but it does not include any warning that these actions affect live user-visible content and may be irreversible. Under the markdown-specific warning criterion, user-impacting actions should be accompanied by a clear disclosure about data or system integrity impact.
This markdown file describes how to delete a post via DELETE /{post-id} but does not include any warning that the action is destructive or may be irreversible. For markdown files, user-facing documentation should warn about behaviors that can affect user data or system integrity.
This markdown file explains passing an access_token and obtaining user and Page access tokens, but it does not include any warning that these tokens are sensitive credentials that should be protected and not exposed in logs, URLs, or shared output. Because markdown files should warn about behaviors affecting privacy or system integrity, the omission is a quality/safety concern.
No suspicious patterns detected.