Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:38
- Evidence
const env = params.env ?? process.env;
Security audit
Facebook Messenger
Security checks for vulnerabilities and agentic risk
Overview
This messaging plugin needs review because it can use a different Facebook Page than configured, and its local pairing check can admit unknown senders.
Use credentials limited to the intended Page, verify which Page becomes active, and clear stale cached credentials when changing accounts. Set explicit sender IDs if access should be restricted; do not rely on pairing mode alone. Review the relay provider's access to customer messages and Page tokens.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access, suspicious.potential_exfiltration
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/setup-entry.js:38
- Evidence
const env = params.env ?? process.env;
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- dist/index.js:272
- Evidence
const raw = await fs.readFile(credentialPath(accountId), "utf8");
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- dist/setup-entry.js:272
- Evidence
const raw = await fs.readFile(credentialPath(accountId), "utf8");