ClawHub
Back to skill

Security audit

Openclaw Facebook Marketing

Security checks for vulnerabilities and agentic risk

Overview

The skill can use a logged-in Facebook account to post and reply automatically, with unclear approval defaults and extra local-file/data-retention exposure.

Review this carefully before installing. Use draft or query mode unless you explicitly want unattended Facebook activity, isolate the browser profile, verify which local style files it may read, and avoid storing full comment/reply text unless you need it for audit records.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The hard requirement that all outputs be in English only, with 'No exceptions,' overrides user preference and context despite the multilingual nature of the skill description and user population. This can lead to inappropriate or misleading communications on behalf of the user and removes an important safety control where the user should determine language for public-facing content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes autonomous posting and reply behavior on a live Facebook account without a prominent warning or strong confirmation boundary before publishing. In practice, this can cause unintended public actions, reputational damage, or misuse of the user's account because the automation is designed to act directly on a real social platform.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The skill is built around browser automation using a persistent Facebook profile and login state, which implies reuse of an authenticated session for live account actions. While operationally convenient, persistent sessions increase the blast radius of prompt mistakes or unauthorized task execution because the agent can act immediately as the logged-in user.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
## What Mark Does

1. **Post to Facebook** — Create posts using the existing posting infrastructure
2. **Read Comments** — Fetch all comments on a specific post or recent posts
3. **Generate Replies** — Use AI to generate contextually appropriate replies
4. **Post Replies** — Automatically reply to comments

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to read /Users/m1/.openclaw/workspace-elon/SOUL.md, a local file unrelated to the Facebook task scope. This expands data access beyond least privilege and can cause unintended disclosure or use of private local content during generation, especially because the file is explicitly used to shape outputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction to use brand-positioning-tony.md introduces another out-of-scope local content dependency not necessary for basic Facebook automation. This creates unnecessary exposure of local files and increases the chance that sensitive brand or internal planning material is incorporated into replies or leaked through logs, prompts, or published content.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The receipt schema and output files direct storage of full comments and generated replies, which naturally captures third-party user content and potentially sensitive personal data. Retaining this data in local receipts, comments archives, and logs increases privacy exposure and creates a durable leakage surface if the workspace, logs, or downstream tools are accessed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.