scrapesocial-facebook
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
scrapesocialCLI tool vianpm install -g scrapesocial. This is a vendor-owned package associated with the skill author, Skill Atlas, and is necessary for its functionality. - [COMMAND_EXECUTION]: The skill maps user-defined goals to specific CLI commands within the
scrapesocialenvironment. This allows the agent to execute local commands to retrieve structured data from Facebook's platform. - [CREDENTIALS_UNSAFE]: The skill uses a
SCRAPECREATORS_API_KEYfor authentication. It correctly instructs users to manage this key through environment variables or command-line flags, avoiding the risk of hardcoded credentials. - [PROMPT_INJECTION]: The skill is exposed to potential indirect prompt injection because it processes content from external Facebook sources (such as posts, comments, and transcripts). 1. Ingestion points: Facebook profiles, posts, groups, and ad content retrieved via CLI commands. 2. Boundary markers: No explicit delimiters or instructions to ignore instructions within the scraped data are provided in the skill guidelines. 3. Capability inventory: The skill can perform package installations and execute shell commands. 4. Sanitization: No explicit content sanitization or validation logic is specified before the retrieved data is processed by the agent.
Audit Metadata