qwe

Facebook Publisher Skill (Automate Page Posts via Graph API)

This skill largely does what it claims (posting to Facebook Pages), but there are several red flags you should address before running it: 1) config.validate() requires OPENAI_API_KEY and APIFY_API_TOKEN even though those services are unused — remove or understand why they are required. 2) The token helper explicitly tells you to pick a specific App ID in Graph Explorer (4348763312075291) — do not use someone else's app; generate tokens with your own app and app secret. 3) The helper prints long-lived tokens to the console and writes them to fb_tokens_output.json; remove printing and file writes or ensure you run in an isolated environment and never commit saved token files. 4) If you plan to run these scripts, run them in an isolated VM/container, review and remove any hardcoded sample values, and avoid pasting production secrets until you confirm the code has been cleaned. Given these issues, proceed only after code cleanup or further verification.

Type: OpenClaw Skill Name: qwe Version: 1.0.0 The skill bundle is a functional toolset designed to automate Facebook Page posts via the Graph API. It includes scripts for token management (fb_token_helper.py), media uploads, and post scheduling (fb_publisher_agent.py). While the bundle handles sensitive credentials and stores them in a local file (fb_tokens_output.json) for user convenience, this behavior is documented and aligned with the stated purpose. No evidence of data exfiltration, malicious execution, or prompt injection was found.