T08 · Insecure Dependencies
Error
- Location
lib/farcaster.sh:4- Finding
Mutable External Programs Receive Social-Media Credentials and Wallet Private Keys
- Content
View full analysis
&2 return 1 fi # ... "$TWITTER_POST_SCRIPT" "$text" } ``` ```bash # lib/farcaster.sh FARCASTER_REPO="/home/phan_harry/.openclaw/workspace/skills/farcaster-agent/repo" cd "$FARCASTER_REPO" && \ PRIVATE_KEY="$private_key" \ SIGNER_PRIVATE_KEY="$signer_key" \ FID="$fid" \ npm run cast "$text" 2>&1 | grep -E "(Cast hash|URL|Error)" | tail -2 ``` The image and reply paths similarly execute Node.js code from the external Farcaster repository while exposing the private keys through environment variables: ```bash cd "$FARCASTER_REPO" && PRIVATE_KEY="$private_key" \ SIGNER_PRIVATE_KEY="$signer_key" \ FID="$fid" \ IMAGE_URL="$image_url" \ PARENT_HASH="${parent_hash:-}" node -e " const { Wallet, JsonRpcProvider } = require('ethers'); const { makeCastAdd, NobleEd25519Signer, FarcasterNetwork, Message } = require('@farcaster/hub-nodejs'); const { submitMessage } = require('./src/x402'); // ... " "$text" ``` ### Technical Analysis The Skill relies on executable components outside the audited project: - `/home/phan_harry/.openclaw/workspace/scripts/twitter-post.sh` - `/home/phan_harry/.openclaw/workspace/skills/farcaster-agent/repo` These external components are not bundled, version-pinned, integrity-checked, or otherwise authenticated by this project. The X posting script inherits the exported OAuth credentials from the calling shell. The Farcaster dependency explicitly receives the custody wa ...[truncated 1373 chars]- Remediation
View remediation