ClawHub
Back to skill

Security audit

Facebook API - Pages, Posts, Reels, Groups, Events

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly describes a Facebook data API integration and its external API calls are expected for that purpose.

Install this only if you are comfortable using Scavio as a third-party API provider for public Facebook data. Keep the API key out of source control, expect credit-based billing, and avoid using the results to profile private individuals or retain expiring downloadable video URLs longer than needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. A page's profile, then its recent posts
profile = requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
posts = requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
# 1. A page's profile, then its recent posts
profile = requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
posts = requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()

# 2. One post in full, plus its top comments

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
json={"url": "https://www.facebook.com/nike"}).json()

# 2. One post in full, plus its top comments
post = requests.post(f"{BASE}/api/v1/facebook/post", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike/posts/pfbid0..."}).json()

# 3. A reel resolved to downloadable HD/SD URLs

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
json={"url": "https://www.facebook.com/nike/posts/pfbid0..."}).json()

# 3. A reel resolved to downloadable HD/SD URLs
reel = requests.post(f"{BASE}/api/v1/facebook/reel", headers=HEADERS,
    json={"url": "https://www.facebook.com/reel/1234567890"}).json()

# 4. Top posts for a hashtag

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

json={"url": "https://www.facebook.com/reel/1234567890"}).json()

4. Top posts for a hashtag

tag = requests.post(f"{BASE}/api/v1/facebook/hashtag", headers=HEADERS, json={"tag": "photography"}).json()

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

curl:

bash
curl -s https://api.scavio.dev/api/v1/facebook/profile \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://www.facebook.com/nike"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

curl:

bash
curl -s https://api.scavio.dev/api/v1/facebook/profile \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://www.facebook.com/nike"}'