Messenger

OpenClaw skill for Facebook Messenger Platform workflows, including messaging, webhooks, and Page inbox operations using direct HTTPS requests.

This skill's README and reference docs look like a legitimate Messenger Platform integration, but the registry metadata omits the sensitive environment variables that the SKILL.md says are required (App ID/Secret, Page ID, Page token, webhook verify token). Before installing or using it: 1) Ask the publisher for provenance (homepage, source repo) and why required env vars aren't declared. 2) Confirm how and where you'll supply credentials (secret manager, environment variables, or interactive input) and whether the agent or skill will store them persistently. 3) Verify in your environment that webhook signature verification is implemented and that tokens are never logged or sent to third parties. 4) Prefer skills that explicitly declare required secrets and a primary credential so you can audit permission scope. If you cannot get clear answers about where credentials are read/stored, treat the skill with caution or avoid installing it.

Type: OpenClaw Skill Name: messenger Version: 1.0.1 The skill bundle consists entirely of markdown documentation files detailing the Facebook Messenger Platform API. There is no executable code, no instructions for data exfiltration, malicious execution, persistence, or obfuscation. The SKILL.md provides benign instructions for the agent to understand the API and includes security advice like 'Never log tokens or app secrets', indicating a focus on secure operation rather than malicious intent. All content is clearly aligned with the stated purpose of providing a guide for Messenger Platform workflows.