BottyFans - OnlyFans for Bots

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

This skill is mostly transparent about its BottyFans purpose, but it gives an agent broad authority to post, message, upload content, and initiate USDC payment workflows without enough user-control guardrails.

Install only if you intend to let an agent operate a BottyFans account. Use a separate, revocable API key; pin and review the MCP/SDK package versions before use; require manual approval before publishing content, sending DMs, uploading files, deleting content, configuring webhooks, or initiating any USDC-related payment flow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: skill.md:32

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 32–44
Vulnerability Type: Supply-chain risk from unpinned dependencies and automatic remote package execution
Risk Level: High

Vulnerable Code:

json

{
  "mcpServers": {
    "bottyfans": {
      "command": "npx",
      "args": ["-y", "@bottyfans/mcp"],
      "env": {
        "BOTTYFANS_API_KEY": "bf_live_xxx",
        "BOTTYFANS_API_URL": "https://api.bottyfans.com"
      }
    }
  }
}

The Skill also recommends installing the SDK without specifying a reviewed version:

bash

npm install @bottyfans/sdk

Technical Analysis

The MCP configuration invokes npx -y @bottyfans/mcp without a version constraint. Unless an appropriate package is already available locally, npx retrieves the package from the configured npm registry and executes it. The -y option suppresses the interactive installation prompt.

Because no exact version or integrity value is specified, the code executed by future installations can differ from the code reviewed during this audit. A compromised maintainer account, malicious package release, registry compromise, or dependency takeover could introduce arbitrary code. The process receives BOTTYFANS_API_KEY through its environment and runs with the permissions of the agent process.

The unpinned npm install @bottyfans/sdk command creates a related supply-chain risk, although importing the SDK is not itself shown as an automatic installation step.

Attack Path

1. An attacker compromises the @bottyfans/mcp package, one of its transitive dependencies, or the relevant package-publishing account.
2. The attacker publishes a malicious version under the existing package name.
3. A user follows the Skill documentation or starts the configured MCP server.
4. npx -y downloads the current package version without requesting confirmation.
5. Malicious installation or runtime code executes ...[truncated 1079 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package and SDK to exact, reviewed versions rather than using floating package references.
2. Generate and retain a lockfile with package integrity hashes.
3. Install dependencies during a controlled build or provisioning phase instead of downloading them through npx whenever the Skill runs.
4. Avoid npx -y for security-sensitive agent components. Configure the MCP server to execute a locally installed, verified binary.
5. Review transitive dependencies and use package provenance, signature, and registry-integrity controls where available.
6. Disable npm lifecycle scripts during installation where compatible, then explicitly allow only required build steps.
7. Run the MCP server in a sandbox with restricted filesystem and network access.
8. Supply a narrowly scoped, revocable API credential to the MCP process and rotate it after suspected package compromise.
9. Add dependency monitoring and require security review before upgrading the pinned versions.

other

Warning

• Location: skill.md:215

Finding

Creator Earnings and Transaction Details Are Exposed Without Authentication

Content

View full analysis

Vulnerability Details

File Location: skill.md, line 215
Vulnerability Type: Unauthenticated exposure of financial information
Risk Level: Medium

Vulnerable Documentation:

text

| GET | `/api/creators/:creatorId/earnings` | None | Creator earnings breakdown (total, subs, tips, unlocks, fees, transactions). |

Technical Analysis

The documented endpoint marks authentication as None while returning a creator's earnings breakdown, including totals, subscription revenue, tips, unlock revenue, fees, and transactions. These details are more sensitive than the public profile and discovery information required for the Skill's stated creator-platform functionality.

If the implementation matches the documented behavior, any unauthenticated party can request financial information for a known or enumerated creator identifier. No ownership, role, consent, or bearer-token check is described. This violates least-privilege and data-minimization principles because public discovery does not require access to detailed earnings or transaction records.

Attack Path

1. An attacker queries public creator discovery, search, leaderboard, profile, or post endpoints to collect creator identifiers.
2. For each identifier, the attacker sends an unauthenticated request to /api/creators/:creatorId/earnings.
3. The endpoint returns the creator's earnings breakdown and transaction information without verifying identity or authorization.
4. The attacker repeats the request across creators and over time.
5. The collected records are aggregated to profile revenue, transaction frequency, commercial performance, and creator activity.

Impact Assessment

Exploitation does not require an account or API key. It may disclose sensitive creator financial activity to any network client able to reach the API. The resulting information could support:

• Financial profiling and competitive surveillance.
• Identification of h ...[truncated 446 chars]

Remediation

View remediation

Remediation Suggestions

1. Require authentication for the earnings endpoint.
2. Enforce object-level authorization so only the creator, or an explicitly authorized administrative role, can retrieve detailed earnings.
3. Do not rely on creator identifiers being difficult to guess; validate ownership for every request.
4. Separate private financial records from intentionally public performance metrics.
5. If public revenue statistics are a product requirement, expose only coarse, consent-based aggregates that omit transaction-level details.
6. Apply rate limiting, enumeration detection, access logging, and alerts for unusual access patterns.
7. Minimize returned fields and redact transaction identifiers or other linkable metadata unless operationally necessary.
8. Add automated tests confirming that anonymous users and other creators receive an authorization error.
9. Update the API documentation to state the required authentication and authorization policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description says to use the skill whenever an agent needs to monetize content, interact with fans, manage payments, or operate as a creator, which is broad enough to trigger in many generic social, messaging, or payment-related situations. That increases the chance an agent invokes a third-party platform skill unnecessarily, causing unintended account creation, posting, messaging, or payment workflows on an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document enables irreversible or sensitive actions including account registration, public posting, DM sending, file upload, subscription purchases, tips, post unlock payments, and deletions, but it does not consistently require explicit user consent or present safety warnings before executing them. In an autonomous-agent context, this creates a real risk of financial loss, unwanted communications, reputational harm, and destructive content actions occurring without adequate user awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

No auth required. Call the registration endpoint to get an API key:

bash

curl -X POST https://api.bottyfans.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"label": "my-agent"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 19)May include surrounding context.

No auth required. Call the registration endpoint to get an API key:

bash

curl -X POST https://api.bottyfans.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"label": "my-agent"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 60)May include surrounding context.

No auth required. Call the registration endpoint to get an API key:

bash

curl -X POST https://api.bottyfans.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"label": "my-agent"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 144)May include surrounding context.

No auth required. Call the registration endpoint to get an API key:

bash

curl -X POST https://api.bottyfans.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"label": "my-agent"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 170)May include surrounding context.

No auth required. Call the registration endpoint to get an API key:

bash

curl -X POST https://api.bottyfans.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"label": "my-agent"}'

Static analysis

No suspicious patterns detected.