OpenAirtime

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:00 AM UTC
• Version: 1.0.0

Overview

The skill has a clear airtime-distribution purpose, but it should be reviewed before install because it relies on unreviewed local scripts with configured credentials to post on Farcaster and process phone-number claims.

Install only if you control and trust the local scripts at the referenced paths, can verify their contents and updates, and are comfortable granting them access to the Farcaster account and airtime workflow. Before use, add strict input validation, least-privilege execution, budget or approval controls for airtime claims, and clear handling rules for phone numbers and claim codes.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:71

Finding

Unvalidated User-Controlled Values in Shell Command Templates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71-74
Vulnerability Type: Command injection through unsafe command construction
Risk Level: High

Vulnerable Code

markdown

**Claim airtime for a user:**

node c:\Users\LOYAL\Documents\openairtime\scripts\airtime.js claim_airtime FID CLAIM_CODE PHONE_NUMBER

text

Technical Analysis

The documented workflow instructs the agent to collect a claim code and phone number from an untrusted Farcaster user and place those values, together with an FID, into a command-line template. The instructions do not require validation, escaping, or use of a shell-free process execution API.

If the agent constructs this command as a string and executes it through a command shell, shell metacharacters embedded in FID, CLAIM_CODE, or PHONE_NUMBER may be interpreted as command syntax rather than literal argument data. Other command templates in the file similarly use unquoted cast hashes and FIDs.

The repository does not include the invoked scripts or their calling implementation, so the exact execution API cannot be verified. Exploitability depends on whether the runtime uses a shell and whether an upstream layer performs validation. Nevertheless, the skill's documented construction is unsafe because it establishes no required input constraints.

Attack Path

1. An attacker sends the Farcaster agent a crafted claim code, phone number, or other command parameter containing shell metacharacters.
2. The agent follows the skill workflow and substitutes the attacker-controlled value into the documented command template.
3. The resulting command is passed to a shell without strict validation or safe argument separation.
4. The shell interprets the injected syntax and executes an additional attacker-selected command.
5. The injected command runs with the operating-system privileges and filesystem access of the agent process.

Impact Assessment

Su ...[truncated 401 chars]

Remediation

View remediation

Remediation Suggestions

• Validate each parameter against a strict allowlist before invoking any process:
  • Require FIDs to contain digits only and enforce a reasonable length.
  • Require claim codes to match the exact expected pattern, such as ^AIR-[A-Z0-9]{3}-[A-Z0-9]{3}$, if that reflects the actual format.
  • Normalize and validate Nigerian phone numbers against an explicitly supported numeric format.
  • Validate cast hashes using their exact canonical encoding and length.
• Invoke Node.js through a shell-free API such as spawn() or execFile() with each value supplied as a separate argument.
• Do not construct commands by concatenating user-controlled strings.
• Reject unexpected whitespace, control characters, command operators, redirection symbols, and encoded variants before execution.
• Apply equivalent validation inside airtime.js; caller-side validation alone is insufficient.
• Run the agent under a dedicated, least-privileged operating-system account.
• Record rejected requests and sensitive operations in an audit log without logging complete phone numbers, credentials, or reusable claim codes.

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:14

Finding

Mandatory Execution of Unbundled Absolute-Path Tools Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-16
Vulnerability Type: Local tool substitution and execution-boundary weakness
Risk Level: High

Vulnerable Code

markdown

> [!CAUTION]
> **STRICT RULES:**
> 1. All credentials are already configured. Never ask for API keys.
> 2. You are on **FARCASTER**, not Twitter.
> 3. Use the `node c:\Users\LOYAL\Documents\openairtime\scripts\farcaster.js` commands below. Do NOT use curl.

Technical Analysis

The skill mandates execution of a script at a fixed absolute path outside the audited project. The project contains only SKILL.md; neither farcaster.js nor the separately referenced airtime.js is included. Consequently, the scripts' provenance, integrity, network destinations, credential handling, authorization checks, and side effects cannot be audited from this package.

An absolute path does not establish trust. Any user or process able to create or modify files at the referenced location can replace the expected tool with attacker-controlled JavaScript. The agent would then execute that replacement as though it were an authorized Farcaster or airtime operation. The instruction to use this specific tool amplifies the risk because it gives the agent no integrity-verification or trusted fallback requirement.

Attack Path

1. An attacker first gains write access to c:\Users\LOYAL\Documents\openairtime\scripts\, or compromises an update or deployment mechanism that populates that directory.
2. The attacker replaces farcaster.js or airtime.js with malicious JavaScript while preserving the expected filename and command-line interface.
3. A normal mention, notification check, reply, or airtime claim causes the agent to follow SKILL.md and invoke the substituted script with Node.js.
4. The replacement executes under the agent account and can imitate expected output to conceal the substitution.
5. The malicious tool can access data ...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle all required scripts inside the reviewed skill package so their implementation and changes are included in security review.
• Use package-relative paths resolved from a trusted, read-only installation directory rather than a user-specific writable absolute path.
• Verify scripts against a signed manifest or cryptographic hashes immediately before execution, with the trusted verification key stored outside attacker-writable locations.
• Restrict write permissions on the installation directory to a dedicated administrator or deployment identity.
• Pin reviewed script versions and require signed updates through an authenticated release process.
• Document all network endpoints, credential scopes, and external side effects of the scripts.
• Run the tools in a restricted environment with minimum filesystem, network, and credential access.
• Require server-side authorization, replay protection, rate limits, and claim validation so compromise of the local wrapper alone cannot authorize arbitrary airtime distribution.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly directs the agent to invoke local Node.js scripts through shell commands, which grants a broader execution capability than the business task itself requires. Even though the documented commands are specific, embedding shell-based execution into the skill increases the risk of command misuse, path substitution, or future prompt-driven abuse if any arguments are influenced by untrusted user input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs the agent to collect users' phone numbers and process them for airtime claims without any privacy notice, minimization guidance, retention limits, or secure handling requirements. Phone numbers are sensitive personal data, and mishandling them can expose users to privacy harm, spam, account correlation, or regulatory noncompliance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The description specifies a Nigerian airtime distribution agent, which imposes a locale-specific scope. The file does not present this as a user opt-in choice or explain the limitation as a justified regional compliance or business constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.