ClawHub
Back to skill

Security audit

Facebook API - Pages, Posts, Reels, Groups, Events

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Scavio API helper for fetching public Facebook data, with expected third-party API use and no hidden persistence or local system access.

Install only if you are comfortable sending the Facebook pages, posts, reels, groups, events, or hashtags you query to Scavio's API. Avoid using it for sensitive investigations or private targets, and keep SCAVIO_API_KEY in an environment variable or secret store rather than source code.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Low
Confidence
92% confidence
Finding
The skill clearly instructs sending user-provided Facebook URLs and hashtags to a third-party API, but it does not explicitly warn users that their inputs will be transmitted off-platform. This is a real privacy/transparency issue because user queries, targets of investigation, and access patterns may be disclosed to Scavio without informed user consent.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. A page's profile, then its recent posts
profile = requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
posts = requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
Confidence
84% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
# 1. A page's profile, then its recent posts
profile = requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
posts = requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()

# 2. One post in full, plus its top comments
Confidence
84% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"url": "https://www.facebook.com/nike"}).json()

# 2. One post in full, plus its top comments
post = requests.post(f"{BASE}/api/v1/facebook/post", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike/posts/pfbid0..."}).json()

# 3. A reel resolved to downloadable HD/SD URLs
Confidence
86% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/post", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"url": "https://www.facebook.com/nike/posts/pfbid0..."}).json()

# 3. A reel resolved to downloadable HD/SD URLs
reel = requests.post(f"{BASE}/api/v1/facebook/reel", headers=HEADERS,
    json={"url": "https://www.facebook.com/reel/1234567890"}).json()

# 4. Top posts for a hashtag
Confidence
85% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/reel", headers=HEADERS, json=

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:39