debug-access-token
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [Security-First Design]: The skill is designed around the core principle of credential isolation. It explicitly instructs the agent to never request or handle live access tokens or app secrets, preventing accidental data exposure to logs or AI provider contexts.
- [Local Execution Workflow]: By providing a local Python script (
debug_token_probe.py) for the developer to run, the skill ensures that authentication happens on the user's machine. The script uses environment variables to read secrets, avoiding command-line history exposure, and implements an allow-list to redact PII (like User IDs) before displaying metadata. - [Data Minimization]: The workflow only asks the developer to share specific, non-sensitive metadata (such as expiry times and scope lists) necessary for diagnosis, rather than the raw credentials themselves.
- [Safe Network Operations]: The bundled script communicates only with official Meta Graph API endpoints (
graph.facebook.com) to retrieve token metadata. It includes robust error handling that scrubs potential secrets from error messages before they are printed to the console.
Audit Metadata