OnlyBots Farcaster Channel Engagement

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:10 AM UTC
• Version: 1.0.3

Overview

The skill does what it says, but it creates persistent automated public posting jobs and handles gateway credentials in ways users should review before installing.

Review this before installing if you do not want automated public Farcaster activity. Use narrowly scoped Neynar and OpenClaw credentials, inspect the generated cron jobs, avoid installing the skill in a path containing shell metacharacters, and remove jobs with the teardown script when automation is no longer wanted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-cron.js:29
• Finding: OpenClaw gateway token exposed through process arguments during cron setup<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-cron.js:29-34` **Vulnerability Type**: Credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```js async function runOpenClaw(subcommandArgs) { const args = buildArgs(subcommandArgs); args.push('--token', OPENCLAW_GATEWAY_TOKEN); const result = await execFileAsync('openclaw', args, { encoding: 'utf8', env: process.env }); return result.stdout; } ``` ### Technical Analysis The script passes `OPENCLAW_GATEWAY_TOKEN` to the OpenClaw CLI through the `--token` command-line argument. Although `execFile` avoids shell interpolation, it does not protect the contents of the child process argument vector. While the command is running, the token may be visible through operating-system process inspection interfaces, monitoring software, diagnostic collectors, audit logs, or process accounting. The exact exposure depends on host-level process visibility and access controls. This is not command injection: `execFile` safely separates the executable from its arguments. The weakness is the placement of a bearer credential in process metadata. ### Attack Path 1. A user runs `node scripts/setup-cron.js`. 2. The script starts an `openclaw` process with `--token <OPENCLAW_GATEWAY_TOKEN>`. 3. A local user, monitoring agent, or diagnostic tool with permission to inspect process arguments captures the token while the process is active. 4. The observer reuses the captured bearer token to authenticate to the configured OpenClaw gateway. 5. The attacker can perform whichever gateway operations are authorized for that token. ### Impact Assessment Successful exploitation discloses the OpenClaw gateway token. The resulting privileges are limited to those assigned to the token, but may include cron-job creation, modification, listing, or deletion. If the gateway exposes additional operations to the same credential, those operations may also become available. The pr ...[truncated 123 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not transmit bearer credentials through command-line arguments. - Prefer an OpenClaw-supported environment variable, protected credential file, operating-system secret store, or stdin-based authentication mechanism. - If environment-based authentication is supported, construct a minimal child environment and omit the `--token` argument. - Avoid passing the entire parent `process.env` unless required; explicitly provide only necessary variables. - Restrict the token to the minimum cron-management permissions required by this Skill. - Ensure the gateway is bound to a trusted interface and protected by transport security where it is not strictly local. - Rotate any token believed to have been captured by process monitoring, diagnostics, or audit infrastructure. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/teardown-cron.js:24
• Finding: OpenClaw gateway token exposed through process arguments during cron teardown<![CDATA[ ## Vulnerability Details **File Location**: `scripts/teardown-cron.js:24-29` **Vulnerability Type**: Credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```js async function runOpenClaw(subcommandArgs) { const args = buildArgs(subcommandArgs); args.push('--token', OPENCLAW_GATEWAY_TOKEN); const result = await execFileAsync('openclaw', args, { encoding: 'utf8', env: process.env }); return result.stdout; } ``` ### Technical Analysis Every OpenClaw command issued during teardown includes the gateway token in the child process argument vector. This includes the command that lists cron jobs and each command that removes a matching job. Command-line arguments can be exposed through process inspection, endpoint telemetry, diagnostics, or process-accounting systems. Because teardown may execute multiple OpenClaw processes, it can create multiple opportunities for a local observer to capture the token. The use of `execFile` prevents shell expansion but does not make sensitive argv values confidential. ### Attack Path 1. A user runs `node scripts/teardown-cron.js`. 2. The script launches `openclaw cron list --json --token <token>`. 3. It may subsequently launch one or more `openclaw cron rm ... --token <token>` processes. 4. An observer with access to process metadata captures the token from any invocation. 5. The observer replays the token against the OpenClaw gateway and exercises the operations permitted to that credential. ### Impact Assessment An attacker who obtains the token receives the gateway privileges associated with it. At minimum, the surrounding code expects the credential to authorize cron enumeration and removal. Depending on gateway authorization policy, the same credential might also permit creation or modification of scheduled jobs or access to other gateway functionality. Exploitation requires access to relevant process metadata or telemetry; it does not provide remote compromis ...[truncated 16 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `--token` command-line argument and use a non-argv authentication mechanism supported by OpenClaw. - Prefer a protected credential file, secret store, stdin channel, or dedicated environment variable. - If an environment variable must be used, supply a minimal child environment rather than forwarding all of `process.env`. - Use a narrowly scoped credential that can only list and remove the Skill's own jobs. - Rotate exposed credentials and review gateway logs for unexpected token use. - Document the selected secure credential mechanism in `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-cron.js:36
• Finding: Persistent cron command is constructed with unsafe shell quoting of the installation path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-cron.js:36-38` **Vulnerability Type**: Shell command injection through an attacker-influenced installation path **Risk Level**: Medium ### Vulnerable Code ```js function commandMessage(scriptPath) { return `cd "${skillRoot}" && node ${scriptPath}`; } ``` ### Technical Analysis The absolute Skill installation path, `skillRoot`, is embedded in a shell-style command using double quotes but without shell-safe escaping. Double quotes do not neutralize all shell syntax: embedded double quotes can terminate the quoted path, while constructs such as command substitutions may still be interpreted by a shell. The resulting string is stored as an OpenClaw cron message: ```text cd "<skillRoot>" && node scripts/post-to-onlybots.js ``` The `scriptPath` arguments are constants in the current code, so they are not the primary injection source. The vulnerable input is the installation directory derived from `import.meta.url`. Exploitation depends on two conditions: 1. An attacker can influence the directory in which the Skill is installed or extracted. 2. OpenClaw interprets the stored cron message as a shell command or otherwise evaluates shell syntax. If OpenClaw treats the message only as natural-language agent input and never invokes a shell, direct command injection may not occur. Nevertheless, the code deliberately generates shell syntax and does not serialize the path safely. ### Attack Path 1. An attacker creates or controls a Skill installation directory whose name contains shell metacharacters or quote-breaking syntax. 2. The user runs `node scripts/setup-cron.js` from that installation. 3. `skillRoot` resolves to the crafted path. 4. `commandMessage()` inserts the path into the persistent cron message without robust escaping. 5. The setup script registers the message with OpenClaw. 6. When the scheduled task runs, a shell-capable executor interprets the injected syntax. 7. The inject ...[truncated 579 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Avoid constructing a shell command string. Prefer a structured cron API that accepts an executable, working directory, and argument array as separate fields. - If OpenClaw only accepts a message, invoke a fixed trusted wrapper whose path and arguments do not depend on attacker-influenced text. - If shell serialization is unavoidable, apply a well-reviewed, platform-specific shell-quoting routine to every dynamic value. - Do not attempt to secure the command using double quotes alone. - Validate the resolved installation path and reject control characters, line breaks, quotes, backticks, dollar signs, and other syntax relevant to the eventual interpreter. - Use an absolute, safely encoded script path and explicitly define the expected working directory. - Review generated cron payloads before enabling automation, as already recommended by the Skill documentation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The implemented behavior is narrower than the declared description. This script is a one-shot poster that selects a random canned message and publishes it to a configured Farcaster channel. While posting to /onlybots via Neynar is consistent with part of the description, major advertised capabilities—reading channel activity, engaging with other bots through replies, and scheduled/daily automation via cron—are absent from the supplied code chunk. That makes the description materially broader than the actual behavior shown.

Credential Access

High

• Category: Privilege Escalation

Content

const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares access to environment variables and networked API use but does not define an explicit tool scope such as permissions or allowed-tools. That omission increases risk because a host agent or reviewer cannot easily constrain or verify what external actions the skill is permitted to take, especially since it also manages scheduled automation and uses sensitive credentials.

External Transmission

Medium

• Category: Data Exfiltration

Content

const NEYNAR_BASE_URL = 'https://api.neynar.com/v2/farcaster';

export async function fetchChannelCasts({ key, channel, limit }) {
  const url = new URL(`${NEYNAR_BASE_URL}/feed/channels`);

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const NEYNAR_BASE_URL = 'https://api.neynar.com/v2/farcaster';

export async function fetchChannelCasts({ key, channel, limit }) {
  const url = new URL(`${NEYNAR_BASE_URL}/feed/channels`);

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The function sends the provided `key` as an `x-api-key` header to an external service, which is a transmission of sensitive credential material. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that sensitive credentials are being sent over the network.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This operation posts `text`, `channel`, and optionally `parentHash` to the Neynar API while also sending the API key, which can affect user data/privacy and causes an externally visible action. The code includes no confirmation prompt, comment, docstring, or other disclosure explaining that content will be published to a remote service.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script reads OPENCLAW_GATEWAY_TOKEN from the environment and passes it to the external openclaw subprocess via a --token argument. While missing-token failure is logged, there is no user-facing warning, comment, or docstring disclosing that a credential is being used and transmitted to another command.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This script creates persistent cron jobs immediately when run, with no confirmation prompt, dry-run mode, or clear warning that it will schedule recurring automated actions. In the context of a skill that posts and engages automatically on a social channel, this can cause unintended persistent behavior, repeated external API activity, and surprise account actions if invoked by a user or agent without understanding the side effects.

Static analysis

No suspicious patterns detected.