Security audit

Skill to manage a facebook page

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Facebook Page management, but it also bundles under-documented X-to-Facebook automation that uses X session cookies and can publish promotional content.

Review this before installing. The core Facebook Page CLI needs real Page authority and stores durable tokens locally, so protect .env and tokens.json and avoid running it in environments with unrelated secrets. The larger concern is the bundled X-to-Facebook automation: do not run x_digest_collect.js or x_digest_to_fb.js unless you explicitly want that workflow, trust the bird executable and X cookie handling, and are comfortable with automatic public posting of generated promotional digest content. A safer package would remove those scripts or document them separately and add confirmation prompts for every publish/delete action.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/x_digest_to_fb.js:40
Finding: Undocumented execution of a PATH-resolved tool with sensitive X session credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/x_digest_to_fb.js:117
Finding: Unrestricted remote media retrieval can enable SSRF, resource exhaustion, and unintended Facebook disclosure
Content: View full analysis
t.media?.some((m) => m.type === "photo" && m.url)); const photoUrl = withPhoto?.media?.find((m) => m.type === "photo" && m.url)?.url; const caption = buildCaption(top); let result; if (photoUrl) { const imgPath = await downloadToTmp(photoUrl); result = await fbUploadPhoto(pageId, pageInfo.token, imgPath, caption); } ``` The collector contains the same unrestricted download pattern: ```js async function download(url) { const resp = await fetch(url); if (!resp.ok) throw new Error(`Failed to download image: ${resp.status}`); const buf = Buffer.from(await resp.arrayBuffer()); const dir = "/tmp/clawdbot-x-digest"; mkdirSync(dir, { recursive: true }); const file = join(dir, `img_${Date.now()}.jpg`); writeFileSync(file, buf); return file; } ``` ### Technical Analysis The URL originates from data returned by the external `bird` process. The code performs no validation of: - URL scheme. - Destination hostname. - Resolved IP address. - Redirect destinations. - Private, loopback, link-local, or cloud metadata address ranges. - Response `Content-Type`. - Response size. - Actual image encoding. - Download timeout. The complete response is buffered in memory with `arrayBuffer()` and then written to ...[truncated 1915 chars]
Remediation: View remediation

other

Warning

Location: scripts/x_digest_to_fb.js:142
Finding: Undocumented automated publication of fixed promotional content
Content: View full analysis
{ const author = t.author?.username ? `@${t.author.username}` : ""; const text = (t.text || "").replace(/\s+/g, " ").trim(); const snippet = text.length > 160 ? text.slice(0, 157) + "…" : text; lines.push(`${i + 1}) ${author}: ${snippet}`); lines.push(` ${tweetUrl(t)}`); }); lines.push(""); lines.push("Theo dõi thêm: clawd.bot | github.com/clawdbot/clawdbot"); lines.push("#Clawdbot #Moltbot #AI #Automation #OpenSource"); return lines.join("\n").slice(0, 6000); } ``` The generated content is published without a preview or confirmation step: ```js if (photoUrl) { const imgPath = await downloadToTmp(photoUrl); result = await fbUploadPhoto(pageId, pageInfo.token, imgPath, caption); } else { const url = new URL(`${FB_BASE}/${pageId}/feed`); url.searchParams.set("access_token", pageInfo.token); const body = new URLSearchParams({ message: caption }); const resp = await fetch(url, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body, }); const data = await resp.json(); if (!resp.ok) throw new Error(`FB error: ${JSON.stringify(data)}`); result = data; } ``` ### Technical Analysis The declared Skill documentation describes general Facebook Pag ...[truncated 1827 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.js:66
Finding: Meta App secrets and access tokens are transmitted in URL query strings
Content: View full analysis
Remediation: View remediation
` where supported by the Meta Graph API. 2. Use POST requests with form-encoded request bodies for OAuth token exchanges rather than placing `client_secret`, authorization codes, and exchange tokens in the URL. 3. Centralize Graph API request construction so every script applies the same credential-handling policy. 4. Add URL and header redaction to all diagnostics, telemetry, and error reporting. 5. Avoid including raw API response bodies in errors when they may contain sensitive context. 6. Ensure proxies and monitoring systems are configured to redact query strings and authorization headers. 7. Rotate the Meta App Secret and revoke stored tokens if URL logs may already have captured them. 8. Use short-lived, least-privilege credentials where practical. 9. Correct the documentation and implementation mismatch regarding token storage and requested permissions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose focuses on Facebook Page management, but the skill also includes OAuth setup, credential ingestion from .env, token exchange, and persistent token storage. That mismatch matters because operators may approve the skill for routine posting while overlooking that it also handles long-lived credentials and authentication state.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose focuses on Facebook Page management, but the skill also includes OAuth setup, credential ingestion from .env, token exchange, and persistent token storage. That mismatch matters because operators may approve the skill for routine posting while overlooking that it also handles long-lived credentials and authentication state.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose focuses on Facebook Page management, but the skill also includes OAuth setup, credential ingestion from .env, token exchange, and persistent token storage. That mismatch matters because operators may approve the skill for routine posting while overlooking that it also handles long-lived credentials and authentication state.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose focuses on Facebook Page management, but the skill also includes OAuth setup, credential ingestion from .env, token exchange, and persistent token storage. That mismatch matters because operators may approve the skill for routine posting while overlooking that it also handles long-lived credentials and authentication state.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill instructs users to handle App ID/App Secret through a local .env file, which means the skill depends on sensitive credentials being present in the working environment. In agent ecosystems, credential-bearing env files are high-value targets because accidental exposure, over-broad tool access, or mishandled logging can leak long-lived application secrets.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

Valid OAuth Redirect URIs: để trống (dùng manual code flow)

Vào App Roles > Roles → thêm account làm Admin/Developer

3. Cấu hình .env

bash
cd skills/facebook-page cp .env.example .env

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Creating and editing a .env file with App ID and Secret introduces a clear credential storage surface on disk. If the host, repository, or agent tooling exposes workspace files, those credentials could be stolen and used to impersonate the app or obtain tokens.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
3. Cấu hình .env

bash
cd skills/facebook-page cp .env.example .env # Edit .env với App ID và Secret

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The explicit instruction to place App ID and Secret into .env normalizes plaintext secret handling without accompanying safeguards. Because these credentials are used for OAuth token exchange, their compromise can enable unauthorized token issuance or abuse of the associated Meta app.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
bash
cd skills/facebook-page cp .env.example .env # Edit .env với App ID và Secret

4. Cài dependencies và lấy token

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · env_example.md (reported line 2)May include surrounding context.
md
# Facebook Page Skill Configuration # Copy this file to .env and fill in your values # Meta App credentials (from developers.facebook.com) META_APP_ID=your_app_id_here

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.js (reported line 18)May include surrounding context.
js
# Facebook Page Skill Configuration # Copy this file to .env and fill in your values # Meta App credentials (from developers.facebook.com) META_APP_ID=your_app_id_here

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.js (reported line 37)May include surrounding context.
js
# Facebook Page Skill Configuration # Copy this file to .env and fill in your values # Meta App credentials (from developers.facebook.com) META_APP_ID=your_app_id_here

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/cli.js (reported line 19)May include surrounding context.
js
# Facebook Page Skill Configuration # Copy this file to .env and fill in your values # Meta App credentials (from developers.facebook.com) META_APP_ID=your_app_id_here

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The documented DELETE /{post-id} operation is a high-risk destructive action that can be abused if an agent accepts untrusted identifiers or executes on insufficiently validated user intent. In this skill context, access tokens with page-management permissions make such abuse more dangerous because the action directly alters public page content and may be irreversible.
Content: Scanner excerpt · references/graph-api.md (reported line 60)May include surrounding context.
Delete post

text
DELETE /{post-id}

Comments

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The documented DELETE /{comment-id} endpoint enables removal of user-generated content and can be misused if an agent is tricked into deleting the wrong comment or acts without strong authorization and intent verification. Because this skill is specifically for managing page engagement, exposure of destructive moderation actions increases the risk of censorship, data loss, or reputation harm.
Content: Scanner excerpt · references/graph-api.md (reported line 86)May include surrounding context.
Delete comment

text
DELETE /{comment-id}

Permissions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.js (reported line 15)May include surrounding context.
js
const __dirname = dirname(fileURLToPath(import.meta.url)); const SKILL_DIR = join(__dirname, ".."); const ENV_FILE = join(SKILL_DIR, ".env"); const TOKENS_FILE = join(SKILL_DIR, "tokens.json"); // Load .env from skill directory

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/cli.js (reported line 16)May include surrounding context.
js
const __dirname = dirname(fileURLToPath(import.meta.url)); const SKILL_DIR = join(__dirname, ".."); const ENV_FILE = join(SKILL_DIR, ".env"); const TOKENS_FILE = join(SKILL_DIR, "tokens.json"); // Load .env from skill directory

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file implements X/Twitter digest collection, credential use, and image downloading even though the declared skill is for Facebook Page management via the Meta Graph API. That mismatch is dangerous because unrelated capabilities can be hidden inside a skill, expanding its effective permissions and enabling unexpected data access or outbound activity that operators and users would not anticipate.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents network access and use of local environment secrets, but it does not declare any explicit tool scope such as allowed tools or permissions. In an agent setting, missing scope boundaries increases the risk of over-broad tool use and makes it harder to enforce least privilege around credential and network operations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The setup flow creates durable authentication state by obtaining long-lived tokens and later storing page tokens on disk. Persistent session material increases the blast radius of a host compromise because an attacker can reuse tokens without re-authenticating to manage pages or moderate content.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
## Setup (một lần) ### 1. Tạo Meta App 1. Vào https://developers.facebook.com/apps/ → Create App 2. Chọn **"Other"** → **"Business"** (hoặc Consumer tuỳ use-case) 3. Điền tên app, email 4. Vào **App settings > Basic**: lấy **App ID** và **App Secret**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill exposes hide and delete comment operations but provides no warning, review step, or confirmation guidance for destructive moderation actions. In agent-driven use, that raises the chance of accidental censorship or irreversible deletion of user content through misunderstanding or prompt error.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The reference documents destructive operations like deleting posts and comments, and hiding comments, without any caution about confirmation, authorization checks, or irreversible effects. In a skill meant to drive agent behavior, this omission can lead an agent or integrator to perform destructive actions too readily based on ambiguous user input or prompt injection.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI exposes a post deletion capability even though the declared skill description only promises posting, listing posts, and comment management. That mismatch expands the skill's effective authority and can lead users or orchestrators to invoke destructive behavior they did not expect, increasing the risk of unauthorized or accidental content removal.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The post deletion command immediately performs a destructive API delete with no confirmation, preview, or warning. A mistyped post ID, automation bug, or prompt-injection-driven invocation could irreversibly remove page content before an operator has a chance to review the action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Comment deletion is also a destructive moderation action, but the command executes immediately without any warning or confirmation. In a skill that may be driven by user requests or higher-level agents, this makes accidental or manipulated deletion of user-generated content much easier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This script performs a real external side-effecting action by publishing content to a Facebook Page as soon as valid arguments and tokens are present, with no built-in confirmation, dry-run mode, or user-visible warning. In an agent setting, that increases the risk of accidental or unauthorized posting if the tool is invoked from ambiguous, injected, or mistaken instructions, potentially causing reputational damage or unwanted public communication.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code downloads remote images to local storage and performs digest collection unrelated to Facebook Page operations. In the context of this skill, those hidden side capabilities increase attack surface through unexpected network fetches, local file writes under /tmp, and use of external credentials, which could be abused for covert data collection or unreviewed content handling.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/x_digest_collect.js:20

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/auth.js:32

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/x_digest_collect.js:14

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/x_digest_to_fb.js:27

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/auth.js:69

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/auth.js:53

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/cli.js:31

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/fb_post.js:66

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/x_digest_to_fb.js:36

Overview

A.I.G

T07 · Tool Hijacking and Spoofing

T09 · Insecure Skill Coding Practices

other

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Tp4

Credential Access

3. Cấu hình .env

Credential Access

3. Cấu hình .env

Credential Access

4. Cài dependencies và lấy token

Credential Access

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Delete post

Comments

Tool Parameter Abuse

Delete comment

Permissions

Credential Access

Credential Access

Description-Behavior Mismatch

Undeclared Tool Scope

Session Persistence

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Static analysis

Shell command execution detected (child_process).

Environment variable access combined with network send.

Environment variable access combined with network send.

Environment variable access combined with network send.

File appears to expose a hardcoded API secret or token.

Sensitive-looking file read is paired with a network send.

Sensitive-looking file read is paired with a network send.

Sensitive-looking file read is paired with a network send.

Sensitive-looking file read is paired with a network send.