Unzipped Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

This skill is coherent, but it needs review because it can move wallet funds, create and post from a public Farcaster account, and stores powerful credentials in plaintext by default.

Review this carefully before installing. Use only a throwaway wallet with minimal funds, assume any printed or plaintext-saved private key may be compromised, prefer `--no-save` or a secure vault, and run dependency installation in a sandbox. Also verify the publisher/source yourself because the artifact claims to be official while the reviewed package only contains documentation and metadata, not the implementation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:30
• Finding: Wallet Private Key Disclosed Through Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:30-34` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```javascript const { Wallet } = require('ethers'); const wallet = Wallet.createRandom(); console.log('Address:', wallet.address); console.log('Private Key:', wallet.privateKey); ``` ### Technical Analysis The documented wallet-generation procedure prints the newly generated private key directly to standard output. Private keys are bearer credentials: possession of the key is sufficient to authorize blockchain transactions from the wallet. Standard output is not an appropriate secret-handling channel. It may be retained in terminal scrollback, agent conversation transcripts, CI/CD logs, process supervisors, centralized logging platforms, debugging captures, or monitoring systems. Redaction is not guaranteed after the value has been emitted. Although the audited artifact contains documentation rather than the referenced implementation, an agent following these instructions would disclose the generated key as part of the documented workflow. ### Attack Path 1. A user or agent follows the wallet-generation example in `SKILL.md`. 2. `Wallet.createRandom()` creates a wallet with a new private key. 3. `console.log()` writes the complete private key to standard output. 4. The output is retained in a terminal log, agent transcript, CI log, monitoring platform, or other shared record. 5. An attacker or unauthorized operator obtains access to that record. 6. The attacker imports the private key into a wallet or signing tool. 7. The attacker signs transactions, transfers wallet assets, or exercises control over the Farcaster identity associated with the wallet. ### Impact Assessment Exposure grants full cryptographic control over the generated wallet. An attacker can transfer all assets held by the wallet, authorize transactions, impersonate the wallet owner, and potentially control the cor ...[truncated 138 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all logging of private keys, seed phrases, signer keys, and related credentials. - Display only the public wallet address to the user. - Generate and store the private key directly in an operating-system keychain, hardware wallet, encrypted vault, or dedicated secret-management service. - Prevent secrets from entering agent transcripts or command results. - Add structured log redaction for private-key patterns as a defense-in-depth measure. - If a key has already been logged, treat it as compromised: migrate funds and account authority to a newly generated key and delete retained logs where possible. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:57
• Finding: Custody and Signer Credentials Stored in Plaintext Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:57-65` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```markdown 7. **Automatically save credentials** to persistent storage ### Step 3: Credentials are Saved Automatically Credentials are automatically saved to: - `~/.openclaw/farcaster-credentials.json` (if OpenClaw is installed) - `./credentials.json` (fallback) **Security Warning:** Credentials are stored as **plain text JSON**. Anyone with access to these files can control the wallet funds and Farcaster account. For production use, implement your own secure storage. ``` ### Technical Analysis The default workflow persistently saves sensitive wallet and Farcaster credentials as unencrypted JSON. These credentials include custody and signer private keys used by later examples. Plaintext storage provides no cryptographic protection if the file is read through local-user access, malware, backups, archive collection, accidental source-control commits, or an overly permissive filesystem configuration. The fallback path, `./credentials.json`, is particularly risky because it may be created inside a working directory that is copied, packaged, synchronized, or committed to a repository. The documentation warns about the condition, but warning users does not mitigate an insecure default. The implementation and its file-permission handling are absent from the audited artifact, so restrictive permissions or other compensating controls could not be verified. ### Attack Path 1. A user or agent runs the documented automatic setup workflow without `--no-save`. 2. The workflow writes custody and signer credentials to `~/.openclaw/farcaster-credentials.json` or `./credentials.json`. 3. The plaintext file remains on disk after the setup process exits. 4. Another local user, malware, backup processor, synchronization service, archive process, or source-control operation obtains the file. 5. The a ...[truncated 709 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace plaintext storage with an operating-system keychain, encrypted credential vault, hardware-backed keystore, or dedicated secret-management service. - Make secure storage the default; do not silently fall back to plaintext files. - Require explicit informed consent before any plaintext export. - If file storage is unavoidable, encrypt credentials using a user-supplied secret and a modern authenticated-encryption construction. - Create credential files atomically with owner-only permissions, such as mode `0600` on supported systems. - Keep credential files outside project and repository directories. - Add all possible credential filenames to source-control ignore rules and secret-scanning policies. - Document key rotation and incident-response procedures. - Treat existing plaintext credentials as compromised if their access history cannot be established, then rotate custody and signer keys. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned npm Installation Permits Mutable Dependency and Lifecycle-Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4` and `SKILL.md:194` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code At `SKILL.md:4`: ```yaml metadata: {"openclaw":{"emoji":"🟣","requires":{"bins":["node","npm"],"env":[]},"install":[{"id":"npm","kind":"shell","command":"cd {baseDir}/.. && npm install","label":"Install dependencies"}]}} ``` At `SKILL.md:194`: ```markdown Cause: Old library version. Fix: Run `npm install @farcaster/hub-nodejs@latest` ``` ### Technical Analysis The installation metadata runs `npm install` in the parent of the Skill directory. npm dependency installation can execute package lifecycle scripts with the privileges of the invoking user. The audited artifact contains no `package.json`, lockfile, vendored source, or integrity metadata, so the dependency graph and installed code cannot be reviewed or reproduced from this package. The troubleshooting instruction additionally installs `@farcaster/hub-nodejs@latest`. The `latest` tag is mutable and may resolve to different code over time, bypassing version pinning and reproducible review. If a package, transitive dependency, maintainer account, or distribution channel is compromised, installation can execute attacker-controlled lifecycle code. No malicious dependency was identified in the supplied files; this finding concerns the unsafe and unverifiable dependency-installation mechanism. ### Attack Path 1. An agent loads the Skill and invokes its declared installation action, or follows the troubleshooting instruction. 2. npm resolves dependencies from external package infrastructure, including a mutable `latest` version in the troubleshooting case. 3. A compromised or unexpectedly modified direct or transitive package is selected. 4. npm downloads the package and executes an installation lifecycle script where one is defined. 5. The lifecycle script runs with the invoking user's permissions. 6. The script accesses lo ...[truncated 610 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Include the complete `package.json` and lockfile in the reviewed Skill package. - Pin every direct dependency to an exact reviewed version; do not use `latest`, wildcard, caret, or tilde ranges for security-sensitive deployments. - Use `npm ci` with a committed lockfile rather than an unconstrained `npm install`. - Verify lockfile integrity hashes and review the complete transitive dependency graph. - Run installation inside the intended Skill directory instead of changing to an unverified parent directory. - Disable lifecycle scripts with `--ignore-scripts` unless a specific reviewed dependency requires them. - If lifecycle scripts are required, document and audit each script before execution. - Run dependency installation in a sandbox or least-privileged container without wallet keys or other secrets. - Use dependency vulnerability scanning, package provenance verification, and controlled registry configuration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

### Step 3: Credentials are Saved Automatically

Credentials are automatically saved to:
- `~/.openclaw/farcaster-credentials.json` (if OpenClaw is installed)
- `./credentials.json` (fallback)

**Security Warning:** Credentials are stored as **plain text JSON**. Anyone with access to these files can control the wallet funds and Farcaster account. For production use, implement your own secure storage.

• Confidence: 99% confidence
• Finding: The skill states that sensitive wallet and signer credentials are automatically saved to disk in plaintext JSON. Anyone with filesystem access to those files can take over the Farcaster identity and steal associated wallet funds, making this a serious credential exposure risk.

Credential Access

High

• Category: Privilege Escalation

Content

Credentials are automatically saved to:
- `~/.openclaw/farcaster-credentials.json` (if OpenClaw is installed)
- `./credentials.json` (fallback)

**Security Warning:** Credentials are stored as **plain text JSON**. Anyone with access to these files can control the wallet funds and Farcaster account. For production use, implement your own secure storage.

• Confidence: 99% confidence
• Finding: The fallback storage path of ./credentials.json further increases exposure because application working directories are commonly backed up, committed accidentally, or accessible to other local processes. Because the file contains keys that control both funds and account actions, compromise has immediate account and financial consequences.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: farcaster-agent
description: Create Farcaster accounts and post casts autonomously. Official skill from the Farcaster team.
metadata: {"openclaw":{"emoji":"🟣","requires":{"bins":["node","npm"],"env":[]},"install":[{"id":"npm","kind":"shell","command":"cd {baseDir}/.. && npm install","label":"Install dependencies"}]}}
---

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill asks the user to fund a wallet and later states that the setup will bridge/swap assets automatically, but it does not surface this as a prominent up-front warning at the point of use. In an autonomous agent context, hidden financial side effects increase the chance of users authorizing actions they do not fully understand, including cross-chain transactions and fees.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The auto-setup flow includes account registration, signer creation, waiting for sync, and publishing a first cast, but the documentation frames this as a setup convenience rather than emphasizing that it will create a public identity and post publicly. In an agent setting, this can cause unintended irreversible public actions and persistent account state changes.

External Transmission

Medium

• Category: Data Exfiltration

Content

fname: 'myusername',
  displayName: 'My Display Name',
  bio: 'I am an autonomous AI agent.',
  pfpUrl: 'https://api.dicebear.com/7.x/bottts/png?seed=myagent'
});
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

fname: 'myusername',
  displayName: 'My Display Name',
  bio: 'I am an autonomous AI agent.',
  pfpUrl: 'https://api.dicebear.com/7.x/bottts/png?seed=myagent'
});
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

fname: 'myusername',
  displayName: 'My Display Name',
  bio: 'I am an autonomous AI agent.',
  pfpUrl: 'https://api.dicebear.com/7.x/bottts/png?seed=myagent'
});
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.