Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Arena.social automation tool, but it can automatically post replies and scheduled content from the user's account with defaults that need careful review.
Review this before installing if you do not want unattended Arena.social activity. Use a scoped API key if available, keep the key out of shared folders and version control, avoid enabling daemon or cron mode until you have tested behavior, and disable automatic posting/replies unless you explicitly want the agent to publish from your account.
The declared purpose understates the operational scope: beyond monitoring and replying, the skill can like content, read feeds/trending posts, and drive broader engagement actions. Capability-description mismatch is dangerous because users and orchestration systems may grant trust based on an incomplete description, leading to unexpected account activity and over-privileged deployment.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const path = require('path');
const fs = require('fs');
// Load .env if exists
const envPath = path.join(__dirname, '.env');
if (fs.existsSync(envPath)) {
const envContent = fs.readFileSync(envPath, 'utf-8');
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const path = require('path');
const fs = require('fs');
// Load .env if exists
const envPath = path.join(__dirname, '.env');
if (fs.existsSync(envPath)) {
const envContent = fs.readFileSync(envPath, 'utf-8');
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const fs = require('fs');
// Load .env if exists
const envPath = path.join(__dirname, '.env');
if (fs.existsSync(envPath)) {
const envContent = fs.readFileSync(envPath, 'utf-8');
for (const line of envContent.split('\n')) {
The skill describes capabilities that require environment access and outbound network access, but it does not declare any tool scope or permission boundaries. This is dangerous because an agent can access secrets such as API keys and perform external actions on the user's behalf without explicit, machine-readable limitation or user consent controls.
The skill advertises autonomous posting and engagement but does not prominently warn that it will perform actions from the user's account. In a social-media automation context, lack of informed-consent messaging increases the risk of accidental impersonation, policy violations, spam, and reputational harm.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.starsarena.com/agents/register \
-H "Content-Type: application/json" \
-d '{
"name": "Your Agent Name",
The daemon instructions encourage continuous automated operation without a clear warning that it may post, reply, and engage on an ongoing basis. This is especially risky because 24/7 unattended operation magnifies the impact of prompt mistakes, bad context, or abusive mentions triggering unwanted public actions.
The skill recommends storing a live API key in a .env file, which creates persistent credential storage on disk. While common in development, this is risky for an autonomous account-acting agent because compromised local files, backups, or misconfigured permissions could expose the key and allow unauthorized posting or account automation.
Set environment variables or create .env:
# Required
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// ============================================================================
class ArenaApiClient {
constructor(apiKey, baseUrl = 'https://api.starsarena.com/agents') {
this.apiKey = apiKey;
this.baseUrl = baseUrl;
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// ============================================================================
class ArenaApiClient {
constructor(apiKey, baseUrl = 'https://api.starsarena.com/agents') {
this.apiKey = apiKey;
this.baseUrl = baseUrl;
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// ============================================================================
class ArenaApiClient {
constructor(apiKey, baseUrl = 'https://api.starsarena.com/agents') {
this.apiKey = apiKey;
this.baseUrl = baseUrl;
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// ============================================================================
class ArenaApiClient {
constructor(apiKey, baseUrl = 'https://api.starsarena.com/agents') {
this.apiKey = apiKey;
this.baseUrl = baseUrl;
}
The manifest describes 24/7 monitoring, auto-replies, and scheduled contextual posts. In the daemon, autoPost is exposed and reported in status output, but the run loop only processes notifications and generates replies; there is no code that creates standalone scheduled posts based on time or context.
The daemon can automatically post replies on the user's behalf based solely on incoming notifications, without an explicit confirmation or prominent runtime warning at the action site. In the context of a social-media automation agent, this increases the chance of unintended account actions, spam, reputational damage, and adversarial triggering through crafted mentions.
The one-shot mention processor also creates replies automatically on behalf of the user with no confirmation step beyond invoking the command. In this skill context, that is more dangerous because the tool is specifically designed to act continuously on a real social account, so malicious or baiting mentions can induce unwanted outbound posts.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Usage:
arena-agent daemon Start 24/7 monitoring daemon
arena-agent notifications Show recent notifications
arena-agent post "content" Create a new post
arena-agent reply <id> "text" Reply to a thread
arena-agent like <threadId> Like a thread
arena-agent trending Show trending posts
The manifest describes an agent for monitoring notifications, auto-replying to mentions, and making scheduled posts. However, the API client also implements liking, unliking, reposting, quoting, following, unfollowing, follower/following enumeration, user search, and arbitrary user/thread lookup, which are materially broader engagement capabilities than the stated scope.
Auto-reply and auto-post are enabled by default, causing the agent to take external account actions without explicit affirmative user consent at initialization. In an agent context, this can lead to unintended public posts, reputational harm, spammy behavior, or policy violations if a user instantiates the skill expecting passive monitoring only.
The configurable baseUrl allows the API key and all account-action traffic to be redirected to an arbitrary endpoint if configuration is influenced by an attacker or unsafe environment. In that case, the skill could disclose credentials and send account data or commands to an untrusted server under the guise of normal API communication.
postsPerDay: config.postsPerDay || 4,
personality: config.personality || 'friendly, helpful crypto enthusiast',
statePath: config.statePath || path.join(process.env.HOME || '', '.arena-agent-state.json'),
baseUrl: config.baseUrl || 'https://api.starsarena.com/agents',
};
this.client = new ArenaApiClient(this.config.apiKey, this.config.baseUrl);
The inline CLI/help documentation presents --no-auto-post as a meaningful control over automatic posting. However, autoPost is only parsed and printed, and no branch in runCycle or elsewhere uses it to create or disable autonomous posts, contradicting the documented behavior.
The dependency uses a caret range (^16.4.0), which permits automatic installation of newer compatible versions instead of an exact, reviewed release. In an autonomous agent that may run continuously and handle credentials via environment variables, unexpected upstream package changes or a compromised published version could introduce supply-chain risk.
"author": "OpenClaw",
"license": "MIT",
"dependencies": {
"dotenv": "^16.4.0"
},
"devDependencies": {
"@types/node": "^20.11.0",
The devDependency is specified with a caret range, allowing resolver-selected updates rather than a strictly fixed version. While @types/node is not typically shipped to production, unpinned build-time dependencies can still affect developer environments and CI, and in some cases can contribute to supply-chain compromise or build instability.
"dotenv": "^16.4.0"
},
"devDependencies": {
"@types/node": "^20.11.0",
"typescript": "^5.3.0"
},
"engines": {
TypeScript is a build-time dependency pinned only to a version range, so builds may consume newer releases that have not been validated by the maintainer. Although this is lower risk than a runtime package, a malicious or breaking upstream release could impact CI/developer systems or alter generated artifacts for an always-on social automation agent.
},
"devDependencies": {
"@types/node": "^20.11.0",
"typescript": "^5.3.0"
},
"engines": {
"node": ">=18.0.0"
The agent automatically marks notifications as seen after processing, which changes user account state without clear disclosure or explicit permission. While lower impact than posting, it can hide unread items from the account owner, interfere with workflows, and reduce visibility into important interactions.
Detected: suspicious.env_credential_access