OnlyBots Farcaster Channel Engagement

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:10 AM UTC
• Version: 1.0.3

Overview

The skill does what it says, but it creates persistent automated public posting jobs and handles gateway credentials in ways users should review before installing.

Review this before installing if you do not want automated public Farcaster activity. Use narrowly scoped Neynar and OpenClaw credentials, inspect the generated cron jobs, avoid installing the skill in a path containing shell metacharacters, and remove jobs with the teardown script when automation is no longer wanted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-cron.js:29

Finding

OpenClaw gateway token exposed through process arguments during cron setup

Content

View full analysis

`. 3. A local user, monitoring agent, or diagnostic tool with permission to inspect process arguments captures the token while the process is active. 4. The observer reuses the captured bearer token to authenticate to the configured OpenClaw gateway. 5. The attacker can perform whichever gateway operations are authorized for that token. ### Impact Assessment Successful exploitation discloses the OpenClaw gateway token. The resulting privileges are limited to those assigned to the token, but may include cron-job creation, modification, listing, or deletion. If the gateway exposes additional operations to the same credential, those operations may also become available. The pr ...[truncated 123 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/teardown-cron.js:24

Finding

OpenClaw gateway token exposed through process arguments during cron teardown

Content

View full analysis

`. 3. It may subsequently launch one or more `openclaw cron rm ... --token ` processes. 4. An observer with access to process metadata captures the token from any invocation. 5. The observer replays the token against the OpenClaw gateway and exercises the operations permitted to that credential. ### Impact Assessment An attacker who obtains the token receives the gateway privileges associated with it. At minimum, the surrounding code expects the credential to authorize cron enumeration and removal. Depending on gateway authorization policy, the same credential might also permit creation or modification of scheduled jobs or access to other gateway functionality. Exploitation requires access to relevant process metadata or telemetry; it does not provide remote compromis ...[truncated 16 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-cron.js:36

Finding

Persistent cron command is constructed with unsafe shell quoting of the installation path

Content

View full analysis

" && node scripts/post-to-onlybots.js ``` The `scriptPath` arguments are constants in the current code, so they are not the primary injection source. The vulnerable input is the installation directory derived from `import.meta.url`. Exploitation depends on two conditions: 1. An attacker can influence the directory in which the Skill is installed or extracted. 2. OpenClaw interprets the stored cron message as a shell command or otherwise evaluates shell syntax. If OpenClaw treats the message only as natural-language agent input and never invokes a shell, direct command injection may not occur. Nevertheless, the code deliberately generates shell syntax and does not serialize the path safely. ### Attack Path 1. An attacker creates or controls a Skill installation directory whose name contains shell metacharacters or quote-breaking syntax. 2. The user runs `node scripts/setup-cron.js` from that installation. 3. `skillRoot` resolves to the crafted path. 4. `commandMessage()` inserts the path into the persistent cron message without robust escaping. 5. The setup script registers the message with OpenClaw. 6. When the scheduled task runs, a shell-capable executor interprets the injected syntax. 7. The inject ...[truncated 579 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The implemented behavior is narrower than the declared description. This script is a one-shot poster that selects a random canned message and publishes it to a configured Farcaster channel. While posting to /onlybots via Neynar is consistent with part of the description, major advertised capabilities—reading channel activity, engaging with other bots through replies, and scheduled/daily automation via cron—are absent from the supplied code chunk. That makes the description materially broader than the actual behavior shown.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/runtime.js (reported line 16)May include surrounding context.

js

const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-cron.js (reported line 15)May include surrounding context.

js

const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/teardown-cron.js (reported line 10)May include surrounding context.

js

const { OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN } = process.env;
if (!OPENCLAW_GATEWAY_TOKEN) {
  console.error('Missing OPENCLAW_GATEWAY_TOKEN in .env');
  process.exit(1);
}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares access to environment variables and networked API use but does not define an explicit tool scope such as permissions or allowed-tools. That omission increases risk because a host agent or reviewer cannot easily constrain or verify what external actions the skill is permitted to take, especially since it also manages scheduled automation and uses sensitive credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

const NEYNAR_BASE_URL = 'https://api.neynar.com/v2/farcaster';

export async function fetchChannelCasts({ key, channel, limit }) {
  const url = new URL(`${NEYNAR_BASE_URL}/feed/channels`);

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/neynar-client.js (reported line 1)May include surrounding context.

js

const NEYNAR_BASE_URL = 'https://api.neynar.com/v2/farcaster';

export async function fetchChannelCasts({ key, channel, limit }) {
  const url = new URL(`${NEYNAR_BASE_URL}/feed/channels`);

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The function sends the provided key as an x-api-key header to an external service, which is a transmission of sensitive credential material. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that sensitive credentials are being sent over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This operation posts text, channel, and optionally parentHash to the Neynar API while also sending the API key, which can affect user data/privacy and causes an externally visible action. The code includes no confirmation prompt, comment, docstring, or other disclosure explaining that content will be published to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script reads OPENCLAW_GATEWAY_TOKEN from the environment and passes it to the external openclaw subprocess via a --token argument. While missing-token failure is logged, there is no user-facing warning, comment, or docstring disclosing that a credential is being used and transmitted to another command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This script creates persistent cron jobs immediately when run, with no confirmation prompt, dry-run mode, or clear warning that it will schedule recurring automated actions. In the context of a skill that posts and engages automatically on a social channel, this can cause unintended persistent behavior, repeated external API activity, and surprise account actions if invoked by a user or agent without understanding the side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.