ClawHub
Back to skill

Security audit

facebook-research

Security checks across malware telemetry and agentic risk

Overview

The skill is Facebook-focused, but its helper can make arbitrary Crawlora API calls with the user's API key.

Review before installing. Use a limited Crawlora key, avoid sensitive searches or identifiers, and prefer a version whose helper only permits the documented Facebook endpoints.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script is documented and structured as a generic Crawlora client, with examples for Amazon, YouTube, and Google endpoints that are unrelated to the stated Facebook-only skill purpose. In an agent context, this expands the tool's reachable capability beyond user expectations and can enable unauthorized access to unrelated data sources using the same API key.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The implementation accepts an arbitrary API path and HTTP method, then forwards them directly to Crawlora with the configured API key. Because the skill is supposed to perform Facebook research only, this creates a capability mismatch that could be abused by prompts or wrappers to query unrelated services through Crawlora under the user's credentials.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The inline documentation explicitly markets the file as a minimal generic REST helper and shows non-Facebook usage patterns, contradicting the skill's declared scope. In security review, this is a strong indicator that the implementation intentionally or carelessly preserves excess capability, increasing the chance of misuse by downstream agent logic.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The endpoint reference documents sending Facebook search terms, location slugs, page identifiers, and an API key to a third-party service, but it does not warn users that their inputs will be transmitted off-platform. This creates a real transparency and privacy risk because users may provide sensitive searches or identifying page targets without understanding that the data is leaving the local agent context and being shared with Crawlora.

External Transmission

Medium
Category
Data Exfiltration
Content
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**2 endpoints across 1 platform group(s).**
Confidence
88% confidence
Finding
https://api.crawlora.net/

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
88% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:23