T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:30- Finding
Wallet Private Key Disclosed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Unzipped Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent, but it needs review because it can move wallet funds, create and post from a public Farcaster account, and stores powerful credentials in plaintext by default.
Review this carefully before installing. Use only a throwaway wallet with minimal funds, assume any printed or plaintext-saved private key may be compromised, prefer `--no-save` or a secure vault, and run dependency installation in a sandbox. Also verify the publisher/source yourself because the artifact claims to be official while the reviewed package only contains documentation and metadata, not the implementation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:57- Finding
Custody and Signer Credentials Stored in Plaintext Files
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:4- Finding
Unpinned npm Installation Permits Mutable Dependency and Lifecycle-Script Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The skill states that sensitive wallet and signer credentials are automatically saved to disk in plaintext JSON. Anyone with filesystem access to those files can take over the Farcaster identity and steal associated wallet funds, making this a serious credential exposure risk.
- Content
md ### Step 3: Credentials are Saved Automatically Credentials are automatically saved to: - `~/.openclaw/farcaster-credentials.json` (if OpenClaw is installed) - `./credentials.json` (fallback) **Security Warning:** Credentials are stored as **plain text JSON**. Anyone with access to these files can control the wallet funds and Farcaster account. For production use, implement your own secure storage.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The fallback storage path of ./credentials.json further increases exposure because application working directories are commonly backed up, committed accidentally, or accessible to other local processes. Because the file contains keys that control both funds and account actions, compromise has immediate account and financial consequences.
- Content
md Credentials are automatically saved to: - `~/.openclaw/farcaster-credentials.json` (if OpenClaw is installed) - `./credentials.json` (fallback) **Security Warning:** Credentials are stored as **plain text JSON**. Anyone with access to these files can control the wallet funds and Farcaster account. For production use, implement your own secure storage.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: farcaster-agent description: Create Farcaster accounts and post casts autonomously. Official skill from the Farcaster team. metadata: {"openclaw":{"emoji":"🟣","requires":{"bins":["node","npm"],"env":[]},"install":[{"id":"npm","kind":"shell","command":"cd {baseDir}/.. && npm install","label":"Install dependencies"}]}} ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill asks the user to fund a wallet and later states that the setup will bridge/swap assets automatically, but it does not surface this as a prominent up-front warning at the point of use. In an autonomous agent context, hidden financial side effects increase the chance of users authorizing actions they do not fully understand, including cross-chain transactions and fees.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The auto-setup flow includes account registration, signer creation, waiting for sync, and publishing a first cast, but the documentation frames this as a setup convenience rather than emphasizing that it will create a public identity and post publicly. In an agent setting, this can cause unintended irreversible public actions and persistent account state changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
fname: 'myusername', displayName: 'My Display Name', bio: 'I am an autonomous AI agent.', pfpUrl: 'https://api.dicebear.com/7.x/bottts/png?seed=myagent' });
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
fname: 'myusername', displayName: 'My Display Name', bio: 'I am an autonomous AI agent.', pfpUrl: 'https://api.dicebear.com/7.x/bottts/png?seed=myagent' });
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
fname: 'myusername', displayName: 'My Display Name', bio: 'I am an autonomous AI agent.', pfpUrl: 'https://api.dicebear.com/7.x/bottts/png?seed=myagent' });
text
Static analysis
No suspicious patterns detected.