meta-business-posting
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlcommands to interact with the Meta Graph API for publishing feed posts and photos. These commands are standard for API interaction and are restricted to the skill's intended purpose. - [EXTERNAL_DOWNLOADS]: Interacts with
graph.facebook.com, which is the official endpoint for a well-known service (Meta). These network operations are necessary for the skill's functionality and do not target suspicious or untrusted domains. - [PROMPT_INJECTION]: The skill handles user-provided data (text, links, and images) to be posted on social media, creating a potential attack surface for indirect prompt injection.
- Ingestion points: Post content, links, and media files are provided by the user or external sources.
- Boundary markers: The skill mandates a 'Hard rule' to show the user the drafted content and obtain explicit approval before publishing, acting as a human-in-the-loop safety check.
- Capability inventory: The agent has the ability to perform network requests (
curl) and automate browser actions. - Sanitization: The instructions recommend URL-encoding for text and links submitted via API.
Audit Metadata