Skill: codedao12/facebook (version 1.0.1)

--- name: facebook description: OpenClaw skill for Facebook Graph API workflows focused on Pages posting, comments, and Page management using direct HTTPS requests. --- # Facebook Graph API Skill (Advanced) ## Purpose Provide a production-oriented guide for building Facebook Graph API workflows for Pages: publishing posts, managing comments, and operating Page content safely using direct HTTPS calls. ## Best fit - You need Page posting and comment workflows. - You want a professional command design and safe operational guidance. - You prefer direct HTTP requests rather than SDKs. ## Not a fit - You need advanced ads or marketing APIs. - You must use complex browser-based OAuth flows. ## Quick orientation - Read `references/graph-api-overview.md` for base URLs, versions, and request patterns. - Read `references/page-posting.md` for Page publishing workflows and fields. - Read `references/comments-moderation.md` for comment actions and moderation flows. - Read `references/permissions-and-tokens.md` for access types and scope guidance. - Read `references/webhooks.md` for subscriptions and verification steps. - Read `references/http-request-templates.md` for concrete HTTP request payloads. ## Required inputs - Facebook App ID and App Secret. - Target Page ID(s). - Token strategy: user token → Page access token. - Required permissions and review status. ## Expected output - A clear Page workflow plan, permissions checklist, and operational guardrails. ## Operational notes - Use least-privilege permissions. - Handle rate limits and retries. - Log minimal identifiers only. ## Security notes - Never log tokens or app secrets. - Validate webhook signatures.

path: references/permissions-and-tokens.md
content: # Permissions and Tokens

## 1) Token types
- User access token (granted via OAuth).
- Page access token (used for Page content actions).

## 2) Common Page permissions
- `pages_manage_posts` (publish and edit Page posts)
- `pages_read_engagement` (read Page content/insights)
- `pages_manage_engagement` (moderate comments)
- `pages_show_list` (list Pages the user manages)

## 3) Recommended flow (high level)
- Obtain user token with required scopes.
- Call `/me/accounts` to get the Page access token.
- Use the Page token for Page publishing and comment moderation.

## 4) Operational guidance
- Use least privilege.
- Store tokens securely and rotate when possible.
- Expect permission review for production use.


path: references/comments-moderation.md
content: # Comments and Moderation

## 1) List comments on a post
- Endpoint: `GET /{post-id}/comments`
- Common fields/params:
  - `fields` (e.g. `id,message,from,created_time`) 
  - `filter` (top-level vs stream)

## 2) Add a comment
- Endpoint: `POST /{post-id}/comments`
- Field: `message`

## 3) Reply to a comment
- Endpoint: `POST /{comment-id}/comments`
- Field: `message`

## 4) Hide or delete a comment
- Hide: `POST /{comment-id}` with `is_hidden=true`
- Delete: `DELETE /{comment-id}`

## 5) Moderation workflow
- Validate comment text.
- Use hide for sensitive content when possible.
- Log minimal identifiers for audit.


path: references/webhooks.md
content: # Webhooks (Pages)

## 1) Subscribe to webhook
- Use the App dashboard to subscribe the Page.
- Configure a callback URL and verify token.

## 2) Verification (GET)
- Expect `hub.mode`, `hub.verify_token`, `hub.challenge`.
- Respond with `hub.challenge` on success.

## 3) Signature validation
- Validate `X-Hub-Signature-256` with your app secret.

## 4) Events to consider
- `feed`, `mentions`, `comments` (depending on needs)

## 5) Reliability
- Acknowledge quickly, then process async.
- Keep handlers idempotent.


path: references/graph-api-overview.md
content: # Facebook Graph API Overview

## 1) Base URL and versioning
- Base: `https://graph.facebook.com`
- Versioned: `https://graph.facebook.com/vXX.X`
- Prefer pinned versions for stability.

## 2) Request style
- HTTP GET for reads.
- HTTP POST for creates/updates.
- HTTP DELETE for deletes (where supported).
- Access token in query (`access_token`) or `Authorization: Bearer` header.

## 3) Page publishing flow (high level)
- Obtain user access token with required scopes.
- Exchange or extend token as needed.
- Retrieve Page access token via `/me/accounts`.
- Use Page token to publish or manage Page content.

## 4) Common objects
- `Page`, `Post`, `Comment`, `User`.

## 5) Common error handling
- `4xx` for permissions/validation.
- `5xx` for transient errors.
- Back off on rate limits and retry safely.


path: references/page-posting.md
content: # Page Posting Guide

## 1) Create a Page post
- Endpoint: `POST /{page-id}/feed`
- Common fields:
  - `message` (text content)
  - `link` (URL to attach)
  - `published` (true/false)
  - `scheduled_publish_time` (unix timestamp)

## 2) Create a photo post
- Endpoint: `POST /{page-id}/photos`
- Common fields:
  - `url` or `source` (binary upload)
  - `caption`
  - `published`

## 3) Create a video post
- Endpoint: `POST /{page-id}/videos`
- Common fields:
  - `file_url` or `source`
  - `description`
  - `published`

## 4) Read posts
- Endpoint: `GET /{page-id}/posts`
- Common fields/params:
  - `fields` (e.g. `id,message,created_time,permalink_url`)
  - `limit`, `since`, `until`

## 5) Update or delete
- Update post: `POST /{post-id}` (fields you want to change)
- Delete post: `DELETE /{post-id}`

## Notes
- Page access token required for publish actions.
- Keep messages concise and avoid frequent edits.


path: references/http-request-templates.md
content: # HTTP Request Templates (Graph API)

## Create Page post
POST `/{page-id}/feed`
```json
{
  "message": "Hello from the bot",
  "published": true
}
```

## Schedule Page post
POST `/{page-id}/feed`
```json
{
  "message": "Scheduled post",
  "published": false,
  "scheduled_publish_time": 1735689600
}
```

## Create photo post
POST `/{page-id}/photos`
```json
{
  "url": "https://example.com/image.jpg",
  "caption": "Caption",
  "published": true
}
```

## List posts
GET `/{page-id}/posts?fields=id,message,created_time,permalink_url&limit=5`

## Add comment
POST `/{post-id}/comments`
```json
{
  "message": "Thanks for your feedback!"
}
```

## Hide comment
POST `/{comment-id}`
```json
{
  "is_hidden": true
}
```

## Delete comment
DELETE `/{comment-id}`


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)