ClawHub
Back to skill

Security audit

facebook_page_ronnie

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Facebook Page operations skill, but it handles powerful Facebook tokens and should be used with careful credential handling and confirmation before posting.

Install only if you intend to let the agent manage the specified Facebook Page. Store tokens and app secrets in protected environment variables or a secret manager, do not paste secrets into chat or logs, rotate any exposed tokens, and require confirmation before any post, comment, reply, or browser-based Facebook action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill includes executable examples that consume highly sensitive credentials such as Facebook app secrets and access tokens, but it does not provide any explicit guidance on secure handling, redaction, storage, or preventing accidental disclosure in logs, terminal history, or chat output. In an agent setting, this increases the chance that credentials are requested, echoed back, or mishandled during troubleshooting, enabling account takeover or unauthorized Page operations if exposed.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
python3 - <<'PY'
import os, urllib.request, ssl, urllib.parse
app_id = os.environ['FACEBOOK_APP_ID']
app_secret = os.environ['FACEBOOK_APP_SECRET']
short_token = os.environ['FACEBOOK_USER_ACCESS_TOKEN']
params = urllib.parse.urlencode({
    'grant_type': 'fb_exchange_token',
Confidence
89% confidence
Finding
os.environ['FACEBOOK_APP_SECRET']

Env Variable Harvesting

High
Category
Data Exfiltration
Content
import os, urllib.request, ssl, urllib.parse
app_id = os.environ['FACEBOOK_APP_ID']
app_secret = os.environ['FACEBOOK_APP_SECRET']
short_token = os.environ['FACEBOOK_USER_ACCESS_TOKEN']
params = urllib.parse.urlencode({
    'grant_type': 'fb_exchange_token',
    'client_id': app_id,
Confidence
86% confidence
Finding
os.environ['FACEBOOK_USER_ACCESS_TOKEN']

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.