facebook-outreach

SUSPICIOUS: the skill’s core capability matches its stated purpose, and installs come from normal developer channels, but it relies on persisted personal-account Facebook session cookies and enables autonomous outbound messaging on the user’s behalf via browser automation rather than an official API. No clear malware or credential exfiltration is shown, yet the credential handling and real-world action scope make the skill medium-to-high risk.

This module does not show classic malware behavior (no backdoor, no reverse shell, no dynamic code execution, no overt exfiltration to unknown domains). However, it has meaningful security and compliance risk: it automates third-party account interaction (scrape contact details and send direct messages), stores sensitive message and scraped contact data in a database, and—independently of intent—weakens database transport security by disabling TLS certificate verification (rejectUnauthorized: false). This warrants review of authorization/consent, data minimization, and the DB TLS setting before use in a supply-chain context.