ClawHub
Back to skill

Security audit

Facebook Publisher

Security checks for vulnerabilities and agentic risk

Overview

This Facebook publishing skill is mostly coherent, but it gives an embedded connector token authority to publish, upload media, schedule posts, and cancel scheduled posts without requiring an explicit final confirmation before those public actions.

Install only if you trust Boring with publish access to your Facebook Pages. Treat the MCP link like a password, verify the connected Page before use, and require the agent to confirm the exact post, media, schedule time, or cancellation target before it takes action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The security section makes a materially misleading claim that 'no content is uploaded or modified' during analytics queries, while the same skill later instructs the agent to upload media and publish or schedule Facebook posts. This inconsistency can mislead users or downstream reviewers about what the integration does, reducing informed consent and increasing the chance of unsafe approval or misuse of a token that has write access.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is broad enough to activate on generic requests like 'manage Facebook scheduled posts' or open-ended desires to create multiple kinds of posts, which raises the risk of the skill being selected in ambiguous contexts. Because the skill uses an embedded auth token with publish privileges, over-broad routing can lead to unintended destructive or externally visible actions on a user's Facebook Page.

Static analysis

No suspicious patterns detected.