scrapesocial-facebook
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute the
scrapesocialCLI tool to perform various Facebook analysis tasks, such as fetching profile metadata, group posts, and ad library information. - [EXTERNAL_DOWNLOADS]: The skill recommends a global installation of the
scrapesocialpackage via NPM (npm install -g scrapesocial). The package is a resource provided by the skill's author (Skill Atlas). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from Facebook, including posts, reels, comments, and transcripts. This creates a vulnerability surface where malicious instructions embedded in the social media content could influence the agent's behavior.
- Ingestion points: Data is fetched from Facebook profile URLs, post URLs, and group URLs via the
scrapesocialcommands. - Capability inventory: The skill facilitates shell command execution and network operations through the use of the
scrapesocialtool. - Boundary markers: The instructions do not define specific delimiters or instructions to the agent to ignore potentially malicious content within the scraped data.
- Sanitization: There is no evidence of sanitization or filtering applied to the external content before it is processed for analysis.
Audit Metadata