Security audit

Facebook Group Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it uses a persistent Facebook login profile and an unsandboxed browser with weak URL and file cleanup safeguards, so it should be reviewed carefully before use.

Install only if you are comfortable storing an authenticated Facebook browser session locally and saving screenshots of group content. Use a dedicated, private workspace, avoid shared screenshot folders, pass only real Facebook group URLs or IDs, and periodically delete .browser-data, .seen-posts.json, and screenshots when no longer needed. This should not be used on hosts where untrusted prompts or users can control the group URL or screenshot directory.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fb-group-monitor.py:363
Finding: Unrestricted Browser Navigation with Chromium Sandbox Disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fb-group-monitor.py:197
Finding: Arbitrary Deletion of JPEG Files Through User-Controlled Screenshot Directory
Content: View full analysis
MAX_SCREENSHOTS: files[0].unlink() files = files[1:] removed += 1 return removed ``` ```python async def cmd_clean_shots(args): shots_dir = Path(args.shots_dir).expanduser() shots_dir.mkdir(parents=True, exist_ok=True) removed = cleanup_screenshots(shots_dir) ``` ```python shots_dir = Path(args.shots_dir).expanduser() shots_dir.mkdir(parents=True, exist_ok=True) if not group_url.startswith("http"): group_url = f"https://www.facebook.com/groups/{group_url}" if take_screenshots: cleanup_screenshots(shots_dir) ``` ```python clean_p.add_argument( "--shots-dir", default=str(DEFAULT_SCREENSHOTS_DIR), help="Thư mục chứa screenshots (default: script_dir/screenshots)" ) scrape_p.add_argument( "--shots-dir", default=str(DEFAULT_SCREENSHOTS_DIR), help="Thư mục lưu screenshots — NÊN trỏ vào workspace để image tool đọc được. " "VD: ~/.openclaw/workspace-daily-digest/temp-screenshots" ) ``` ### Technical Analysis Both `scrape` and `clean-shots` accept an arbitrary filesystem path through `--shots-dir`. The path is expanded and created but is not constrained to the Skill directory or an approved workspace directory. The cleanup ...[truncated 1376 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/SETUP.md:17
Finding: Unpinned Python and Browser Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill performs file read/write operations for persistent browser session data, dedup state, and screenshots, but it does not declare an explicit tool scope or permissions boundary. That makes the effective capabilities less visible to reviewers and orchestrators, increasing the chance of overbroad file access or unintended data exposure from stored Facebook session artifacts and scraped content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match generic requests like 'monitor group' or 'Facebook marketplace,' which can cause the skill to activate when the user did not specifically intend browser automation, scraping, persistent login usage, or screenshot capture. In this context, unintended invocation is more dangerous because the skill accesses authenticated Facebook content and stores scraped images and state on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill prominently describes persistent login storage and stitched screenshots of Facebook group feeds, but it does not present a clear user-facing warning about the privacy and security implications of storing authenticated session data and capturing potentially sensitive third-party content. This omission increases the risk of users enabling the skill without understanding that private group posts, images, and session artifacts may be retained locally and exposed to other tools or operators.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup guide explicitly instructs users to create and retain a persistent authenticated Facebook session in a local browser profile for weeks to months, but it does not warn about the sensitivity of that stored session or how compromise of the local profile could enable account takeover. In the context of a browser automation skill that uses stealth mode and persistent login, this increases the risk of unauthorized access if the host, workspace, backups, or shared filesystem are exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill launches a persistent Playwright browser context backed by .browser-data, which retains Facebook authentication state on disk, and it separately stores scraped state in .seen-posts.json plus optional screenshots on the filesystem. In an agent/tooling environment, these retained artifacts can expose session cookies, account access, and scraped group content to other local users, later runs, or workspace-accessible tools without any explicit user warning, consent flow, or protection boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill hard-codes locale="vi-VN" and timezone_id="Asia/Ho_Chi_Minh", which imposes a specific language/locale behavior on all users. This matches the policy-violation category because there is no opt-in, configuration option, or documented justification that the skill is intended only for a Vietnam-specific context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.