FB Inbox Forward

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:21 AM UTC
• Version: 1.0.10

Overview

The skill has a clear forwarding purpose, but it handles Facebook Page tokens and private messages through a persistent listener with insecure token and runtime handling that should be reviewed before installation.

Install only if you are comfortable giving this skill access to a Facebook Page token and forwarding full inbound message text to the configured OpenClaw destination. Review or patch it to use Authorization headers, sanitized error logging, bounded message delivery, and a fixed or integrity-checked worker script before running the listener.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:137

Finding

Facebook access token may be exposed through request URLs and exception logging

Content

View full analysis

$null } -ArgumentList $channel, $target, $notify | Out-Null } $state | Add-Member -NotePropertyName $conv.id -NotePrope ...[truncated 2563 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:158

Finding

Unbounded PowerShell background-job accumulation enables resource exhaustion

Content

View full analysis

$null } -ArgumentList $channel, $target, $notify | Out-Null ``` ### Technical Analysis The persistent listener creates a new PowerShell background job for every Facebook message it forwards. Redirecting the returned job object to `Out-Null` does not remove the job from the PowerShell job repository. The code never calls `Wait-Job`, `Receive-Job`, or `Remove-Job`, and it does not impose a concurrency limit. Completed jobs and their retained state can therefore accumulate for the lifetime of the worker. If `openclaw message send` blocks or the destination is unavailable, active jobs can also accumulate concurrently. This creates an avoidable denial-of-service condition. As the worker's purpose is continuous forwarding, it should use synchronous execution or explicitly bounded and cleaned-up asynchronous execution. ### Attack Path 1. The user starts the background listener. 2. An attacker or automated account repeatedly sends messages to the monitored Facebook Page. 3. The worker detects the messages and creates one `Start-Job` instance for each forwarded message. 4. Completed jobs remain registered because the worker never receives or removes them. 5. If the OpenClaw destination is slow or unavailable, multiple active jobs additionally remain in memory. 6. Job metadata, process resources, and buffered output state progressively consume memory and other operating-system resources. 7. The worker or its host becomes degraded or unavailable, interrupting message forward ...[truncated 625 chars]

Remediation

View remediation

$null if ($LASTEXITCODE -ne 0) { Write-Log "Message delivery failed." } ``` 2. If asynchronous execution is required, impose a strict concurrency limit and clean up every completed job using `Receive-Job` and `Remove-Job`. 3. Periodically enumerate completed, failed, and stopped jobs and remove them: ```powershell Get-Job | Where-Object State -in @('Completed', 'Failed', 'Stopped') | ForEach-Object { Receive-Job -Job $_ -ErrorAction SilentlyContinue | Out-Null Remove-Job -Job $_ -Force } ``` 4. Add a timeout for each OpenClaw delivery operation so an unavailable destination cannot leave jobs running indefinitely. 5. Apply backpressure through a bounded queue. Define a maximum queue size and a clear overflow policy rather than spawning unlimited work. 6. Consider deduplication, rate limiting, and batching to reduce the effect of abusive or unusually high inbound message volume. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · _meta.json (reported line 10)May include surrounding context.

json

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · _meta.json (reported line 15)May include surrounding context.

json

---
name: fb-inbox-forward
description: "Forward Facebook Page inbox messages to your OpenClaw channel in real time. Requires: powershell/pwsh + openclaw CLI. Reads ~/.config/fb-page/credentials.json (FB_PAGE_TOKEN, FB_PAGE_ID) and ~/.config/fb-inbox-forward/config.json (NOTIFY_CHANNEL, NOTIFY_TARGET). Listener opt-in only — never starts autonomously. Logs metadata only; no message content written to disk. All calls go to graph.facebook.com only."
metadata: {"openclaw":{"emoji":"[fb-fwd]","requires":{"anyBins":["powershell","pwsh"]}}}
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The test-credentials command places the access token directly in the request URL query string. Tokens in URLs are commonly captured in shell history, verbose logs, proxy logs, diagnostic output, or exception messages, increasing the chance of credential disclosure even if the destination host is legitimate.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Test credentials:

powershell

$fb = Get-Content "$HOME/.config/fb-page/credentials.json" -Raw | ConvertFrom-Json
$r  = Invoke-RestMethod "https://graph.facebook.com/v25.0/me?access_token=$($fb.FB_PAGE_TOKEN)" -ErrorAction Stop
Write-Host "Connected as: $($r.name)"

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · _meta.json (reported line 27)May include surrounding context.

json

"Credentials read fresh from disk at runtime — never embedded as literals in any script. All runtime files permission-restricted. Logs contain sender name and conv ID only."
                          },
    "persistence":  {
                        "type":  "background-process",
                        "code":  "inline",
                        "optional":  true,
                        "description":  "Polls Facebook Page conversations every POLL_INTERVAL_SEC seconds (default 15). Transmits: sender name + full message text + conv ID to NOTIFY_CHANNEL/NOTIFY_TARGET via openclaw message send. Message text goes to the channel destination only — never written to disk. Logs record sender name and conv ID only. Worker stored at ~/.config/fb-inbox-forward/worker.ps1 with restricted permissions. Credentials read fresh from disk at runtime — no tokens embedded as literals. Never starts autonomously — opt-in only."
                    },
    "requires":  {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

$f = "$dir/$"; if (Test-Path $f) { icacls $f /inheritance:r /grant:r "$($env:USERNAME):(R,W)" | Out-Null } } } else { Get-ChildItem $dir | ForEach-Object { & chmod 600 $.FullName } }

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The start routine reconstructs worker.ps1 by parsing ~/.openclaw/skills/fb-inbox-forward/SKILL.md at runtime instead of using a fixed embedded script or integrity-checked artifact. If that skill file is modified locally by another process or attacker, the listener will execute attacker-controlled PowerShell with the same access to Facebook credentials and message forwarding, turning a documentation file into an execution source.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md

$pidFile   = "$configDir/listener.pid"

# Write worker — exact content as shown in WORKER SCRIPT section above
$workerContent = Get-Content "$HOME/.openclaw/skills/fb-inbox-forward/SKILL.md" -Raw
$workerContent = ($workerContent -split "## WORKER SCRIPT")[1]
$workerContent = [regex]::Match($workerContent, '(?s)```powershell\r?\n(.*?)```').Groups[1].Value
Set-Content $worker -Value $workerContent -Encoding UTF8

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

} else {
    $worker, $logFile, $stateFile, $pidFile | ForEach-Object {
        New-Item $_ -Force -ItemType File -ErrorAction SilentlyContinue | Out-Null
        & chmod 600 $_
    }
    $proc = Start-Process pwsh -ArgumentList "-NonInteractive -File `"$worker`"" -PassThru -RedirectStandardOutput "/dev/null" -RedirectStandardError "/dev/null"
}

Static analysis

No suspicious patterns detected.