Meta Business Suite

Meta Business Suite automation via Graph API. Use this skill when: (1) Publishing posts to Facebook Pages (2) Scheduling Facebook posts (3) Publishing to Ins...

This skill appears to be a straightforward Graph API cookbook, but review these points before installing: - Sensitive file access: SKILL.md contains Python one-liners that read ~/.meta_tokens_cache.json to extract tokens and IG IDs. That file is sensitive and the skill metadata does not declare it. If you do not maintain such a file, the commands may fail; if you do, be aware the skill explicitly reads it. Consider removing or relocating that file or avoid using the 'Option B' cache approach. - Environment variables: The skill declares META_PAGE_ACCESS_TOKEN and META_PAGE_ID (appropriate). It references IG_ID in examples but does not declare it; either set IG_ID yourself or confirm how it will be derived. Prefer setting tokens via environment variables rather than caches. - Token scope: The token can create, edit, and delete posts and manage comments. Use a token with the minimum permissions required, and rotate/revoke tokens you pass to any third-party skills. - Operational safety: Commands include destructive actions (DELETE for posts). Confirm the agent only performs actions you explicitly request; do not give long-lived or highly privileged tokens to untrusted agents. - If you want stronger assurance: ask the skill author to (1) declare the ~/.meta_tokens_cache.json path in metadata if it's intended, (2) document IG_ID as an explicit env var option, and (3) provide explicit guidance about required token scopes and safety checks before destructive operations. Given the mismatch between documented requirements and the instructions' optional file access, proceed only after addressing the above or using isolated/limited credentials.

Type: OpenClaw Skill Name: meta-business-suite Version: 1.0.4 The skill is designed for Meta Business Suite automation, utilizing `curl` and `python3` to interact with the Meta Graph API. While its core functionality aligns with its stated purpose, it exhibits several risky capabilities. Specifically, it reads sensitive credentials from `~/.meta_tokens_cache.json` using `python3 -c` for token retrieval and allows uploading arbitrary local files via `curl -F "source=@/path/to/image.jpg"` for Facebook posts, both found in `SKILL.md`. These operations, while necessary for the skill's function, grant significant file system access and command execution primitives. If the OpenClaw agent runtime does not rigorously sanitize user-provided input before executing these commands, a malicious user could exploit these capabilities for shell injection or unauthorized file access, making the skill suspicious due to its inherent attack surface rather than explicit malicious intent.