Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
FB Personal Poster
v1.0.0Post text and photos to personal Facebook timeline using browser automation (Patchright/Playwright). Use when: user asks to post to personal Facebook, publis...
⭐ 0· 46·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, SKILL.md, and the included Python script all consistently implement posting to a personal Facebook timeline via Patchright/Playwright using session cookies or Playwright storage state. There are no unrelated services or credentials requested by the code; the required functionality (cookies/state and Playwright) is coherent with the stated purpose.
Instruction Scope
SKILL.md and the script instruct the agent to read a Facebook cookies JSON (FB_COOKIE_FILE) or Playwright storage state and to control a Chromium browser to navigate and interact with facebook.com. This is within the expected scope for automating personal-posting, but it requires full session cookies (which grant broad account access). The instructions also advise installing packages and running 'python -m patchright install chromium' — these steps are explicit and expected. No instructions appear to exfiltrate data to other endpoints.
Install Mechanism
There is no opaque download URL; the SKILL.md asks to pip install the requirement (patchright) and install Chromium via patchright. That is a common pattern for Playwright-like tooling. Note: pip installs can pull arbitrary code — verify the package source and version before installing in a sensitive environment.
Credentials
The skill requires a Facebook session cookie JSON (FB_COOKIE_FILE) and a writable FB_STATE_FILE as declared in SKILL.md and used in the script; these are sensitive because cookies provide full account access. However, the registry metadata lists no required environment variables or primary credential — a mismatch that reduces transparency. Requiring cookies is proportionate to the stated goal but the metadata omission is concerning and should be corrected/verified before use.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or global agent settings, and has no service that would persistently run beyond user invocation. It writes/reads a local state file if configured, which is expected for Playwright sessions.
What to consider before installing
This skill appears to do what it says (automated posting to a personal Facebook timeline) but it requires a Facebook session cookie file (FB_COOKIE_FILE) which grants full access to your account. Before installing or running it: (1) verify the skill source and owner — the package shows no homepage and registry metadata omits the env vars the SKILL.md requires; treat this as a red flag. (2) Inspect the code yourself (or have someone you trust do so) and run in an isolated environment or throwaway account. (3) Do not reuse cookies from an important account — use a disposable/test account if possible. (4) Prefer the dry-run mode (FB_DRY_RUN=true) to confirm behavior first. (5) Confirm the patchright package/version you install comes from the official PyPI maintainer and consider pinning the version. (6) If you are not comfortable exporting and storing session cookies, avoid using this skill — browser automation that reuses session cookies can perform any action your account can, and could violate Facebook's terms of service or cause account lockouts.Like a lobster shell, security has layers — review code before you run it.
latestvk9750hw7ht0z72kz1mq8d7gr0x83r6tg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.