Facebook Management Skills by MCBAI

Quản lý và đăng nội dung tự động lên Facebook Fanpage qua Graph API. Hỗ trợ đầy đủ: post text/ảnh, carousel (nhiều ảnh), video, Reels, Story (ảnh/video), hẹn...

Security Scan

The skill's code and docs match the stated Facebook Page management purpose, but the package metadata omits the environment variables/credential usage the script relies on (FB_ACCESS_TOKEN / FB_PAGE_ID), which is an important inconsistency you should understand before installing.

Purpose & Capability

Name, description, README, references, SKILL.md and the Python script all consistently implement Facebook Page management via the Graph API (posts, photos, carousel, video/Reels, story, scheduling, comments). The network endpoints are only graph.facebook.com and align with the stated functionality.

Instruction Scope

SKILL.md instructs creating a local config file (scripts/fb_config.json) containing the Page access token and page_id and also documents using Graph API Explorer to obtain tokens. The runtime script additionally falls back to environment variables FB_ACCESS_TOKEN and FB_PAGE_ID when the config file is absent — but the skill metadata declared no required env vars. The code only accesses local media files for uploads and the Facebook Graph API, which is expected, but the un-declared env usage is a scope/metadata mismatch.

Install Mechanism

This is an instruction-only skill with a bundled Python script. There is no install spec that downloads code from third-party URLs. Dependencies are minimal (requests via pip). No risky external installers or archive extraction are present.

Credentials

The skill metadata reports no required credentials, but the script requires a Page Access Token and Page ID (via scripts/fb_config.json or the environment variables FB_ACCESS_TOKEN and FB_PAGE_ID). Those credentials are powerful (posting/moderation access to a Page); the omission in metadata is a mismatch and should be corrected. The skill's guidance discusses token scopes and warns to .gitignore the config file, which is appropriate, but the inherent risk of long-lived Page tokens (they may be 'never expires') means leaking the token would allow full page posting/managing.

Persistence & Privilege

always is false and the skill does not request permanent platform-level privileges. The skill stores/reads its own local config file (fb_config.json) and/or environment variables; it does not modify other skills or system-wide settings.

What to consider before installing

The code appears to do exactly what the description promises and only contacts Facebook's Graph API. However: (1) The package metadata does not declare the environment variables the script can read (FB_ACCESS_TOKEN, FB_PAGE_ID) — treat this as a packaging oversight and assume the skill needs a Page Access Token. (2) Page tokens with the listed scopes can post, delete, and moderate; if leaked they allow full control of the Page. Do not store a long-lived Page token on shared machines or in repositories; follow the README advice to add fb_config.json to .gitignore, and prefer using a secure secret store or environment variables with limited exposure. (3) Review the token scopes you grant (only the permissions needed) and consider creating a dedicated Facebook App and Page token for automated use, revoking it after testing. (4) If you need stronger assurance, ask the publisher to update the registry metadata to list FB_ACCESS_TOKEN and FB_PAGE_ID as required env vars (or clearly state the config file usage) and to provide a trusted homepage or source repo. If you proceed, run the script in an isolated environment and be ready to revoke the token quickly if anything unexpected occurs.

Facebook Page Manager

Skill đăng và quản lý nội dung Facebook Page qua Graph API v19.0 bằng Python.

Setup nhanh

1. Cài dependencies

pip install requests

2. Lấy Access Token

Xem hướng dẫn chi tiết: references/get-token.md

Tóm tắt nhanh:

• Vào Graph API Explorer
• Tạo token với permissions: pages_manage_posts, pages_read_engagement, pages_manage_engagement, publish_video
• Gọi GET /me/accounts để lấy Page Access Token và Page ID

3. Tạo config

Tạo file scripts/fb_config.json:

{
  "access_token": "EAAxxxxxxxxxxxxxxx",
  "page_id": "123456789012345"
}

⚠️ Thêm vào .gitignore, không commit file này!

---

Script chính: scripts/fb_post.py

Đăng text

python fb_post.py text --message "Nội dung bài viết"

Đăng ảnh

python fb_post.py photo --message "Caption" --images anh1.jpg

Carousel (nhiều ảnh)

python fb_post.py photo --message "Caption" --images a.jpg b.jpg c.jpg

Video

python fb_post.py video --message "Caption" --video clip.mp4

Reels

python fb_post.py video --message "Caption" --video clip.mp4 --reel

Story ảnh

python fb_post.py story --type photo --media story.jpg

Story video

python fb_post.py story --type video --media story.mp4

---

Hẹn giờ đăng bài

Thêm --schedule "YYYY-MM-DD HH:MM" vào bất kỳ lệnh text/photo/video:

python fb_post.py text --message "Bài sáng thứ Hai" --schedule "2024-12-25 08:00"
python fb_post.py photo --message "Caption" --images anh.jpg --schedule "2024-12-25 10:00"
python fb_post.py video --message "Video mới" --video clip.mp4 --schedule "2024-12-25 20:00"

⏰ Thời gian phải sau hiện tại ít nhất 10 phút và không quá 6 tháng. Story không hỗ trợ hẹn giờ.

---

Quản lý lịch đăng

Xem danh sách bài hẹn giờ

python fb_post.py list-scheduled

Xóa bài

python fb_post.py delete --post-id 123456789_987654321

Đổi giờ đăng

python fb_post.py reschedule --post-id 123456789_987654321 --schedule "2024-12-26 09:00"

---

Quản lý Comment

Permission cần thêm: pages_manage_engagement

Comment vào bài viết

python fb_post.py comment --post-id 123456789_987654321 --message "Nội dung comment"

Reply vào comment

python fb_post.py reply --comment-id COMMENT_ID --message "Nội dung reply"

Xem danh sách comment của bài viết

python fb_post.py list-comments --post-id 123456789_987654321

Xóa comment

python fb_post.py delete-comment --comment-id COMMENT_ID

---

References

• references/get-token.md — Hướng dẫn lấy Access Token từng bước
• references/api-reference.md — Chi tiết endpoints, format, giới hạn

Lưu ý quan trọng

• Page phải ở trạng thái Published (không phải Unpublished/Restricted)
• Video upload có thể mất vài phút xử lý sau khi upload xong
• Carousel tối đa 10 ảnh theo giới hạn Facebook
• Reels phải từ 3-90 giây
• Comment/Reply cần permission pages_manage_engagement
• Nếu gặp lỗi permission, xem references/get-token.md phần Troubleshooting