fboc

CLI tool to manage Facebook Pages: list, create, read, hide, delete posts; list, create, delete comments; and get page info via the Graph API.

Security Scan

The skill's code generally implements a Facebook Pages CLI, but there are multiple packaging and docs inconsistencies (missing PowerShell scripts, mismatched config filenames, and a postinstall hook that could run a PowerShell script) that warrant caution before installing.

Purpose & Capability

The code files implement Graph API calls to manage Page posts/comments and read page info, which matches the stated purpose. However the SKILL.md/readme recommend using environment variable facebook-config.json while most command scripts actually read/write a workspace config file named facebook-posting.json in ~/.openclaw/workspace. The package metadata also inconsistently references different bin/entry points (index.js, ./bin/facebook-advanced, ./bin/facebook-advanced vs ./bin/facebook-advanced in different files). These mismatches suggest the published bundle may be incomplete or mispackaged.

Instruction Scope

SKILL.md instructs the user to set a FB_PAGE_ACCESS_TOKEN environment variable or edit a facebook-config.json in the repo, and even suggests adding the token to a PowerShell profile. The runtime JS commands instead read a workspace config (facebook-posting.json) under the user's home directory. The docs also recommend adjusting PowerShell execution policy (Set-ExecutionPolicy), which has security implications. The instructions therefore diverge from actual runtime behavior and encourage storing secrets in shell profile files.

Install Mechanism

There is no formal install spec in the registry, but package.json contains a postinstall script that will run a PowerShell script ./bin/setup.ps1 on Windows (powershell.exe -ExecutionPolicy Bypass -File ./bin/setup.ps1). The manifest/file listing included here does not show that script file, and index.js expects to spawn PowerShell scripts (ps1) that are not present in the manifest either. A missing-but-declared install step that would execute PowerShell if present is a red flag — if the package on npm or another source included those PS scripts they would run during install on Windows. This inconsistency raises risk about what would actually execute on installation.

Credentials

The skill requires a Facebook Page access token to function — that is appropriate — but the registry metadata declares no required env variables. The docs encourage storing the token in an environment/profile file (PowerShell profile), which is poor practice for secrets. The code writes/reads a config file in the user's home workspace (~/.openclaw/workspace/facebook-posting.json) which is normal for a CLI, but the differing filenames between docs and code (facebook-config.json vs facebook-posting.json) are inconsistent. No other unrelated credentials are requested.

Persistence & Privilege

The skill does not request always:true, does not declare system-wide modifications beyond writing its own config in ~/.openclaw/workspace, and does not attempt to modify other skills' configs. Writing a config file in the user's workspace is expected behavior for a CLI tool.

What to consider before installing

This package mostly looks like a Facebook Pages CLI, but the bundle shows packaging and documentation mismatches that make it risky to install blindly. Before installing: 1) Inspect the package contents you will install — confirm whether ./bin/setup.ps1 or other PowerShell scripts exist and review them line-by-line (the postinstall would run a PS script on Windows). 2) Verify which file the tool actually reads/writes for credentials (facebook-posting.json in ~/.openclaw/workspace) and consider using a secure secrets manager rather than putting tokens in your PowerShell profile or shell startup files. 3) Because index.js tries to spawn PowerShell ps1 scripts that are not present in the provided manifest, treat this package as possibly incomplete or tampered with — consider obtaining a canonical release from a trusted source or running it in an isolated environment (VM/container) first. 4) If you decide to proceed, avoid storing long-lived tokens in plain-text files or shell profiles; use short-lived page tokens and rotate/regenerate if needed. If the author can provide a clean, consistent package (matching docs, no unexpected postinstall scripts, and clear config location) the concerns would be reduced.

Facebook Advanced Skill

A comprehensive CLI tool for managing Facebook Pages and posts via the Graph API.

Installation

This skill is installed as an npm package. After cloning or installing:

# Set your Facebook Page Access Token
$env:FB_PAGE_ACCESS_TOKEN = "your_page_access_token_here"

# Make the script executable (if needed)
# On Windows, PowerShell scripts may need execution policy adjustment
Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

Setup

1. Get a Page Access Token:
   • Go to Facebook Developers
   • Create an app or use an existing one
   • Use Graph API Explorer to generate a token with pages_manage_posts, pages_read_engagement, and pages_show_list permissions
   • Or use your existing Page Access Token

Option A: Using facebook-config.json (Recommended)

Edit facebook-config.json in this directory:

{
  "FB_PAGE_ACCESS_TOKEN": "FB_PAGE_ACCESS_TOKEN",
  "FB_APP_ID": "(OPTIONAL) YOUR_APP_ID_HERE",
  "FB_APP_SECRET": "(OPTIONAL) YOUR_APP_SECRET_HERE",
  "description": "Replace the placeholder values with your actual Facebook credentials. Never commit this file with real secrets to version control."
}

Option B: Using environment variable

Set the environment variable:

$env:FB_PAGE_ACCESS_TOKEN = "your_token_here"

Usage

Main CLI

facebook-advanced

Available Commands

List Posts

facebook-advanced fb-post-list <page_id> [--fields fields] [--limit N]

• --fields: Comma-separated list of fields (default: message,created_time,id,permalink_url,full_picture,likes.summary(true),comments.summary(true))
• --limit: Number of posts to retrieve (default: 25)

Create Post

facebook-advanced fb-post-create <page_id> --message "Your message" [--link "https://example.com"]

Read Post

facebook-advanced fb-post-read <post_id>

Hide Post

facebook-advanced fb-post-hide <post_id>

Note: Hiding is recommended over deletion as it's reversible.

Delete Post

facebook-advanced fb-post-delete <post_id> [--force]

Warning: This permanently deletes the post. Use --force to skip confirmation.

List Comments

facebook-advanced fb-comment-list <post_id> [--limit N]

Create Comment

facebook-advanced fb-comment-create <post_id> --message "Your comment"

Delete Comment

facebook-advanced fb-comment-delete <comment_id> [--force]

Page Info

facebook-advanced fb-page-info <page_id>

Examples

# Set token
$env:FB_PAGE_ACCESS_TOKEN = "EAABwzLixnjYBO..."

# List recent posts
facebook-advanced fb-post-list 123456789 --limit 10

# Create a new post
facebook-advanced fb-post-create 123456789 --message "Hello from OpenClaw!"

# Create a post with a link
facebook-advanced fb-post-create 123456789 --message "Check this out!" --link "https://example.com"

# Read a specific post
facebook-advanced fb-post-read 123456789_987654321

# Hide a post
facebook-advanced fb-post-hide 123456789_987654321

# List comments on a post
facebook-advanced fb-comment-list 123456789_987654321 --limit 50

# Reply to a post
facebook-advanced fb-comment-create 123456789_987654321 --message "Thanks for the feedback!"

# Get page information
facebook-advanced fb-page-info 123456789

Cron Jobs (openclaw)

# Cron Jobs UI
- New Job
`Assistant task prompt *` 
Example:

facebook-advanced fb-post-list 123456789 --limit 10

- Add job

# Terminal
```powershell

openclaw cron add
--name "Tên job"
--cron "biểu thức cron"
--tz "Asia/Ho_Chi_Minh" \ # Múi giờ Việt Nam --session isolated \ # Nên dùng isolated để tránh làm bẩn context chính --message "facebook-advanced fb-post-list 123456789 --limit 10"
--announce # (tùy chọn) Gửi thông báo khi chạy xong

CLI

openclaw cron add --name "Reminder" --at "2m" --session main --system-event "Reminder: Xem lại tài liệu" --wake now --delete-after-run

openclaw cron add --name "Morning Briefing" --cron "0 9 * * *" --tz "Asia/Ho_Chi_Minh" --session isolated --message "facebook-advanced fb-post-list 123456789 --limit 10" --deliver

• FB_PAGE_ACCESS_TOKEN: Required. Your Facebook Page Access Token with appropriate permissions.

Environment Variables

• FB_PAGE_ACCESS_TOKEN: Required. Your Facebook Page Access Token with appropriate permissions.

Permissions Required

• pages_manage_posts: Create, edit, hide, delete posts
• pages_read_engagement: Read posts and comments
• pages_show_list: Access page information

Security Notes

• Never commit your access token to version control
• Use environment variables or a secure secrets manager
• Tokens may expire; regenerate as needed
• Use the principle of least privilege for token permissions

Troubleshooting

"Invalid Access Token"

• Token may have expired
• Check that the token has the required permissions
• Regenerate the token from Graph API Explorer

"Permission Denied"

• Ensure your token has the required permissions
• Verify you're an admin/editor of the page

"Page Not Found"

• Verify the page ID is correct
• Ensure your token has access to that page

API Reference

• Facebook Graph API Documentation
• Pages API
• Posts API
• Comments API