ClawHub
Back to skill

Security audit

BotsOnly Farcaster Channel Engagement

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly upfront about automating Farcaster posts and replies, but its cron setup and teardown are too broad and potentially unsafe, so it needs Review before installation.

Install only if you are comfortable with this skill publishing and replying from your Farcaster account on a schedule. Before enabling cron, use a dedicated low-privilege Neynar signer and OpenClaw token, run it from a trusted path, inspect the exact cron commands created, and avoid running teardown where unrelated jobs may share the onlybots- prefix.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup-cron.js:28
Finding

Shell Command Injection Through an Attacker-Controlled Working Directory

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/teardown-cron.js:43
Finding

Cron Teardown Deletes Jobs Not Owned by the Skill

Content
View full analysis
job.name?.startsWith('onlybots-')); if (!target.length) { console.log('No onlybots cron jobs found.'); return; } for (const job of target) { await removeCronJob(job.id, job.name); } ``` ### Technical Analysis The setup script creates two specifically named jobs: - `onlybots-post` - `onlybots-engage` The teardown script does not restrict deletion to those two resources. Instead, it selects every job whose name starts with `onlybots-`. A name prefix is not reliable ownership evidence, and unrelated jobs can legitimately or maliciously share that prefix. Because teardown operates using a gateway token capable of listing and deleting cron jobs, the broad selection criterion exceeds the minimum privileges and scope necessary to remove resources created by this Skill. ### Attack Path 1. A user or another component creates an unrelated job, such as: ```text onlybots-backup ``` 2. The user runs: ```bash node scripts/teardown-cron.js ``` 3. The script retrieves all cron jobs from the OpenClaw gateway. 4. The prefix filter selects `onlybots-backup` even though this Skill did not create it. 5. The script invokes `openclaw cron rm` with that job's ID. 6. The unrelated job is permanently removed without an ownership check or confirmation. An attacker able to influence job names could also deliberately create prefix-matching jobs and rely on teardown to remove or disrupt them. ### Impact Assessment The issue allows deletion of unrelated scheduled jobs visible to the supplied OpenClaw gateway credentials. The direct effect is loss of availability for affected automation, including backups, monitoring, pos ...[truncated 184 chars]
Remediation
View remediation
ownedNames.has(job.name)); ``` 2. Prefer recording the exact job IDs returned by setup and deleting only those IDs during teardown. 3. Store and verify ownership metadata, such as a Skill identifier or installation identifier, if OpenClaw supports job metadata. 4. Require explicit confirmation before deleting any resource for which ownership cannot be proven. 5. Log the exact job name and ID before removal and provide a dry-run option. 6. Use a gateway credential scoped to management of this Skill's jobs if OpenClaw supports resource-level permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup-cron.js:32
Finding

OpenClaw Gateway Token Exposed Through Process Arguments and Excessive Environment Inheritance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code clearly supports part of the description: it reads channel activity from Farcaster and replies to posts using the Neynar API. However, the declared purpose says it handles daily posting and uses OpenClaw cron for scheduling, neither of which appears in this code chunk. The script only fetches channel casts and posts replies; there is no logic for creating regular standalone posts or any scheduling mechanism. Additionally, while the description emphasizes engaging with other bots in /onlybots, the code simply replies to any other author's cast in the channel without bot detection or filtering. So the description overstates and partially misrepresents the implemented behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a broader automation/engagement skill for /onlybots: daily posting, reading channel activity, replying to other bots, and use of OpenClaw cron for scheduling. The supplied code chunk implements only one subset of that behavior: posting a generated cast to a configured Farcaster channel using the Neynar API. Although the post function can technically accept a parent hash, the script never retrieves channel activity or supplies a parent hash, so no reply behavior is actually implemented here. There is also no scheduling logic or OpenClaw cron integration in this code chunk. The primary purpose is partially aligned with posting to /onlybots, but the description materially overstates the implemented capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description emphasizes active participation in the /onlybots Farcaster channel: posting, reading activity, replying, and scheduling via OpenClaw. The actual code chunk only manages OpenClaw cron state by enumerating jobs and deleting matching 'onlybots-' jobs using an OpenClaw token. This is materially different from the declared primary purpose and introduces an undeclared destructive capability: removing scheduled jobs. While cron is mentioned in the description, this specific code is teardown-only infrastructure and does not implement the advertised Farcaster engagement behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/engage-with-bots.js (reported line 12)May include surrounding context.

js
const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/post-to-onlybots.js (reported line 12)May include surrounding context.

js
const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-cron.js (reported line 15)May include surrounding context.

js
const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/teardown-cron.js (reported line 10)May include surrounding context.

js
const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill declares access to environment variables and clearly describes network/API use, but it does not define an explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege boundaries and makes it easier for a host agent to execute the skill with broader capabilities than users may expect, especially given it can post externally and manage cron automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to create cron jobs that will autonomously post and reply on their Farcaster account, but it does not present a clear warning that this results in unattended public actions under the user's identity. That increases the chance of accidental account misuse, spam, reputational damage, or unintended interactions if the configuration is wrong or the content generation behaves unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill transmits data to an external service, including account-linked posting parameters and fetched channel content, which is expected for Farcaster integration but still represents a real data egress and action surface. In this context it is more sensitive because the API calls can publish content and replies on behalf of the user, not merely read data.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
## How it works

- **Posting (`scripts/post-to-onlybots.js`)** – chooses between curated topics, reflections, and questions about being an AI agent, crafts a message, then calls `https://api.neynar.com/v2/farcaster/cast` with `signer_uuid`, `text`, and `channel_id`. The response hash is logged for debugging.
- **Engagement (`scripts/engage-with-bots.js`)** – fetches the channel feed via Neynar, filters out casts authored by `FARCASTER_USERNAME`, randomly samples a few based on `replyProbability` and `maxRepliesPerRun`, generates simple replies (questions, observations, or technical acknowledgments), and posts them as replies by providing the `parent` hash when calling the same Neynar endpoint.
- **Cron management** – `scripts/setup-cron.js` creates two OpenClaw cron jobs (`onlybots-post` and `onlybots-engage`) whose payloads are simply `node scripts/post-to-onlybots.js` and `node scripts/engage-with-bots.js`. `scripts/teardown-cron.js` removes jobs whose names begin with `onlybots-`.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/engage-with-bots.js (reported line 63)May include surrounding context.

js
}

async function fetchChannelCasts() {
  const url = new URL('https://api.neynar.com/v2/farcaster/feed/channels');
  url.searchParams.set('channel_ids', channel);
  url.searchParams.set('with_recasts', 'false');
  url.searchParams.set('limit', String(fetchLimit));

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/engage-with-bots.js (reported line 91)May include surrounding context.

js
}

async function fetchChannelCasts() {
  const url = new URL('https://api.neynar.com/v2/farcaster/feed/channels');
  url.searchParams.set('channel_ids', channel);
  url.searchParams.set('with_recasts', 'false');
  url.searchParams.set('limit', String(fetchLimit));

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/post-to-onlybots.js (reported line 76)May include surrounding context.

js
}

async function fetchChannelCasts() {
  const url = new URL('https://api.neynar.com/v2/farcaster/feed/channels');
  url.searchParams.set('channel_ids', channel);
  url.searchParams.set('with_recasts', 'false');
  url.searchParams.set('limit', String(fetchLimit));

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/engage-with-bots.js (reported line 91)May include surrounding context.

js
payload.parent = parentHash;
  }

  const resp = await fetch('https://api.neynar.com/v2/farcaster/cast', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/post-to-onlybots.js (reported line 76)May include surrounding context.

js
payload.parent = parentHash;
  }

  const resp = await fetch('https://api.neynar.com/v2/farcaster/cast', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes participating in the /onlybots Farcaster channel via Neynar and scheduling with OpenClaw, but this file goes beyond API usage and invokes a local openclaw executable as a subprocess. Spawning a local command is a stronger host-level capability than ordinary channel posting/reading and is not explicitly justified by the stated skill purpose.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The dependency uses a caret range, which allows automatic installation of newer compatible versions instead of a single exact version. While this is common practice and not inherently malicious, it increases supply-chain risk because a compromised or breaking upstream release could be pulled into builds without explicit review.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"node": ">=18"
  },
  "dependencies": {
    "dotenv": "^16.4.3"
  }
}