Publora Facebook

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill does what it says—helps publish or schedule Facebook Page posts through Publora—but users should protect the Publora key and confirm public posts before sending.

Install/use this skill only if you intend the agent to help publish to Facebook Pages through Publora. Keep the Publora API key private, verify the connected Page IDs and final post content before publishing or scheduling, and review the referenced Publora core skill for authentication and upload details.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked with valid credentials, the agent can create or schedule public Facebook Page posts and upload media.

Why it was flagged

The skill instructs the agent how to create, schedule, and upload media for Facebook Page posts through Publora. This is expected for the stated purpose, but it can publish public content.

Skill content

fetch('https://api.publora.com/api/v1/create-post', { method: 'POST' ... platforms: ['facebook-123456789'] }); ... scheduledTime: '2026-03-20T13:00:00.000Z' ... await fetch(upload.uploadUrl, { method: 'PUT' ... body: imageBytes });

Recommendation

Confirm the exact Page IDs, post text, media files, and scheduled time before sending any API request, especially when posting to multiple pages.

Note

ASI03: Identity and Privilege Abuse

What this means

A valid Publora key tied to Facebook Page permissions could allow posting through the connected account or workspace.

Why it was flagged

The skill requires delegated Publora/Facebook authority, including an API key and Facebook Page admin permissions. This is purpose-aligned but sensitive.

Skill content

Header: `x-publora-key: sk_YOUR_KEY` ... `Page admin permissions granted during OAuth` ... `Publora auto-refreshes page tokens`

Recommendation

Store the Publora key only in a trusted credential mechanism, limit it to the intended workspace/pages where possible, and revoke or rotate access if the skill is no longer needed.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

This review covers only the Facebook-specific instruction file, not the referenced core Publora guidance.

Why it was flagged

This skill depends on a separate core Publora skill for important auth and workflow details, but that separate skill is not part of the supplied artifacts.

Skill content

For auth, core scheduling, media upload, and workspace/webhook docs, see the `publora` core skill.

Recommendation

Review the Publora core skill separately before relying on its authentication, workspace, webhook, or upload instructions.