facebook-research
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits a user-provided API key (
CRAWLORA_API_KEY) to the vendor's API endpoint (api.crawlora.net) to authenticate requests. This is standard functionality for an API-integrated skill. - [PROMPT_INJECTION]: The skill processes data from external Facebook listings and public Pages, which serves as a potential surface for indirect prompt injection.
- Ingestion points: Data is received from the
/facebook/marketplace/searchand/facebook/{page}API endpoints. - Boundary markers: None identified in the instructions to separate external data from system prompts.
- Capability inventory: The skill uses a bash script (
scripts/crawlora.sh) to executecurlcommands for data retrieval. - Sanitization: No explicit sanitization or filtering of the retrieved JSON data is performed within the provided scripts before it is processed by the agent.
Audit Metadata