Security audit

Meta Business Suite

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Meta social-media automation guide, but it handles powerful account tokens and destructive post deletion with weak safeguards.

Review before installing if you will connect a real business account. Use least-privilege Meta tokens, prefer environment variables or a tightly protected cache, avoid putting access tokens in URLs, and require explicit user confirmation before publishing, commenting, scheduling, or deleting content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:151
Finding: Meta Access Tokens Exposed in URL Query Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
PAGE_ID="$META_PAGE_ID"

text
The same Page Access Token works for both Facebook and Instagram (the IG Business account is linked to the Page). ### Option B: Token cache file (alternative)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
PAGE_ID="$META_PAGE_ID"

text
The same Page Access Token works for both Facebook and Instagram (the IG Business account is linked to the Page). ### Option B: Token cache file (alternative)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Text post

bash
curl -X POST "https://graph.facebook.com/v25.0/$PAGE_ID/feed" \ -d "message=Tu mensaje aquí" \ -d "access_token=$PAGE_TOKEN"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
-d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

Step 2: Publish

curl -X POST "https://graph.facebook.com/v25.0/$IG_ID/media_publish"
-d "creation_id=$CONTAINER_ID"
-d "access_token=$PAGE_TOKEN"

text

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
-d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") # Step 2: Wait for processing curl -s "https://graph.facebook.com/v25.0/$CONTAINER_ID?fields=status_code&access_token=$PAGE_TOKEN" # Poll until status_code = "FINISHED" # Step 3: Publish

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
md
-d "is_carousel_item=true" \ -d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") IMG2=$(curl -s -X POST "https://graph.facebook.com/v25.0/$IG_ID/media" \ -d "image_url=https://example.com/img2.jpg" \ -d "is_carousel_item=true" \ -d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
md
-d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") # Step 2: Create carousel container CAROUSEL=$(curl -s -X POST "https://graph.facebook.com/v25.0/$IG_ID/media" \ -d "media_type=CAROUSEL" \ -d "children=$IMG1,$IMG2" \ -d "caption=Mi carrusel #carousel" \

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
Option B: Token cache file (alternative)

If environment variables are not set, credentials can be read from ~/.meta_tokens_cache.json (chmod 600):

bash
PAGE_TOKEN=$(python3 -c "

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Text post

bash
curl -X POST "https://graph.facebook.com/v25.0/$PAGE_ID/feed" \ -d "message=Tu mensaje aquí" \ -d "access_token=$PAGE_TOKEN"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents a direct DELETE call for Facebook posts without any warning, confirmation step, or guidance to verify the target post ID. In an automation context, this increases the chance of accidental irreversible content deletion if the agent or user supplies the wrong identifier.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
-d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

Step 2: Publish

curl -X POST "https://graph.facebook.com/v25.0/$IG_ID/media_publish"
-d "creation_id=$CONTAINER_ID"
-d "access_token=$PAGE_TOKEN"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
-d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") # Step 2: Wait for processing curl -s "https://graph.facebook.com/v25.0/$CONTAINER_ID?fields=status_code&access_token=$PAGE_TOKEN" # Poll until status_code = "FINISHED" # Step 3: Publish

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
md
-d "is_carousel_item=true" \ -d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") IMG2=$(curl -s -X POST "https://graph.facebook.com/v25.0/$IG_ID/media" \ -d "image_url=https://example.com/img2.jpg" \ -d "is_carousel_item=true" \ -d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
md
-d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])") # Step 2: Create carousel container CAROUSEL=$(curl -s -X POST "https://graph.facebook.com/v25.0/$IG_ID/media" \ -d "media_type=CAROUSEL" \ -d "children=$IMG1,$IMG2" \ -d "caption=Mi carrusel #carousel" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
-d "access_token=$PAGE_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")

Step 3: Publish

curl -X POST "https://graph.facebook.com/v25.0/$IG_ID/media_publish"
-d "creation_id=$CAROUSEL"
-d "access_token=$PAGE_TOKEN"

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Instagram delete example exposes an irreversible DELETE operation with no warning about permanence or validation guidance. In a skill intended for automation, this can lead to unintended data loss or unauthorized cleanup if the wrong media ID is used.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
md
- Reels may take time to process — poll status before publishing - Schedule Facebook posts at least 10 minutes in advance - Instagram does NOT support native scheduling via API - File permissions on cache: `chmod 600 ~/.meta_tokens_cache.json`

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Multiple example payloads use Spanish text such as 'Tu mensaje aquí' and similar fixed-language content, while the skill does not state that it is Spanish-specific or give the user a language option. This can violate the language/locale policy when a skill implicitly defaults to one language without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:309

Overview

A.I.G

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credential Access

External Script Fetching

Text post

External Script Fetching

Step 2: Publish

External Script Fetching

External Script Fetching

External Script Fetching

Sudo/Root Execution

Option B: Token cache file (alternative)

External Transmission

Text post

Missing User Warnings

External Transmission

Step 2: Publish

External Transmission

External Transmission

External Transmission

External Transmission

Step 3: Publish

Missing User Warnings

Sudo/Root Execution

Natural-Language Policy Violations

Static analysis

File appears to expose a hardcoded API secret or token.