Security audit

Facebook Manager

Security checks for vulnerabilities and agentic risk

Overview

This Facebook management skill is not clearly malicious, but it asks for powerful Facebook tokens and gives posting, messaging, deletion, and reading capabilities without enough scoping or safety guidance.

Install only if you intend to give an agent authority over your Facebook page or account. Use the least-privileged dedicated Meta app and token possible, avoid personal User Tokens unless you truly need group/profile access, never share or log tokens, review any refresh script or cron job before use, and require explicit confirmation before posting, deleting, replying, messaging, or reading private/social data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documented required environment variable conflicts with the actual configuration, which needs FACEBOOK_PAGE_ID, FACEBOOK_PAGE_TOKEN, and FACEBOOK_USER_TOKEN. This mismatch can cause operators to misconfigure secrets, place credentials in unintended locations, or grant broader access than expected while troubleshooting.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger terms are extremely broad and cover common Facebook-related conversation, increasing the chance that the skill activates in contexts where users did not intend account access or API operations. In a skill that can post content, read conversations, and access groups, over-broad invocation materially raises privacy and misuse risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises access to Messenger conversations, group posts, and personal information without a clear privacy notice, consent boundary, or limitation on sensitive data handling. Because the skill operates on social data tied to user and third-party accounts, lack of warnings and safeguards increases the risk of unauthorized collection, exposure, or overreach.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The reference explicitly documents endpoints that can post content, delete posts, reply to comments, and send Messenger messages, but it provides no warning about requiring explicit user authorization, confirmation for destructive actions, or safeguards against abusive outreach. In a skill intended to manage Facebook pages and messaging, this omission increases the risk that an agent could perform harmful or policy-violating actions on behalf of a user without adequate consent boundaries.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document instructs use of bearer access tokens and includes endpoints for retrieving personal information, group membership, conversations, and messages, but it does not include privacy, retention, or token-handling warnings. Because this skill is designed for Facebook management across page and user tokens, the lack of guidance around least privilege, secure storage, and consent materially raises the chance of credential misuse or unauthorized access to personal data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The guide instructs users to place long-lived and permanent Facebook tokens directly into a local configuration file, but does not present a prominent warning at the point of use about the sensitivity and persistence of those credentials. If that file is exposed through backups, local compromise, screen sharing, or source control, an attacker could gain durable access to Facebook pages or account-scoped data.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The refresh script rewrites a local config file containing credentials and prints token-derived output, but does not warn users about securing the modified file, avoiding backups/version control exposure, or validating the destination path before overwrite. This increases the chance of accidental credential leakage or insecure persistence during routine maintenance.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script reads Facebook access tokens from environment variables and transmits them to the Facebook Graph API, but it provides no explicit warning that highly sensitive credentials are being used or sent over the network. In a skill centered on Facebook management for pages and user accounts, this is more dangerous because operators may paste or export powerful long-lived tokens without understanding the handling and exposure risks.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Printing even a partial page access token to stdout leaks credential material into terminal history, logs, screenshots, and CI/CD job output. In this skill's context, those tokens can grant page management capabilities, so partial disclosure meaningfully aids token identification and can expose secrets in environments where output is centrally collected.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script exposes part of the user access token in console output, which is especially sensitive because user tokens may grant access to personal account data, groups, and broader Graph API actions. In a Facebook management skill that explicitly supports user tokens and group access, this increases the danger because compromise could affect personal accounts and associated data, not just a page.

Static analysis

No suspicious patterns detected.