scrapesocial-facebook

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute the scrapesocial CLI tool to perform various Facebook analysis tasks, such as fetching profile metadata, group posts, and ad library information.
  • [EXTERNAL_DOWNLOADS]: The skill recommends a global installation of the scrapesocial package via NPM (npm install -g scrapesocial). The package is a resource provided by the skill's author (Skill Atlas).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from Facebook, including posts, reels, comments, and transcripts. This creates a vulnerability surface where malicious instructions embedded in the social media content could influence the agent's behavior.
  • Ingestion points: Data is fetched from Facebook profile URLs, post URLs, and group URLs via the scrapesocial commands.
  • Capability inventory: The skill facilitates shell command execution and network operations through the use of the scrapesocial tool.
  • Boundary markers: The instructions do not define specific delimiters or instructions to the agent to ignore potentially malicious content within the scraped data.
  • Sanitization: There is no evidence of sanitization or filtering applied to the external content before it is processed for analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:55 AM