File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- index.js:397
- Evidence
const apiKey = [REDACTED]();
Security audit
Openclaw Facebook Crawler
Security checks for vulnerabilities and agentic risk
Overview
This Facebook crawler is not obviously malicious, but it needs Review because it can use a logged-in browser/Facebook session, collect phone numbers and UIDs, store scraped content, and run scheduled automation.
Install only if you control the relevant OpenClaw, Zalo, browser, and Facebook account context and have permission to collect data from the configured groups. Before enabling cron, review the configured groups, admins, cookie use, AI gateway, notification target, local result/content folders, and blacklist behavior; set retention/deletion practices for scraped posts, images, phone numbers, and UIDs.
Static analysis
Detected: suspicious.exposed_secret_literal