social-postcjo

• Analyzed: May 12, 2026, 4:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: cfd6e1ae0b07ae7b0b6241196bab993ba489bb8ad4d2336acb676b7668be3a83
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to its requirement for storing highly sensitive credentials, including Farcaster custody and signer private keys, and Twitter API secrets, in plain text files (`~/.openclaw/.env` and `~/.openclaw/farcaster-credentials.json`). While the `SKILL.md` documentation explicitly warns users about the security risks of plain-text storage and advises securing the system and file permissions, this method itself constitutes a significant vulnerability. The actual execution logic resides in external shell scripts (`scripts/post.sh`, `scripts/reply.sh`, etc.) which are not provided, preventing a full assessment of potential shell injection or other runtime risks. No direct evidence of malicious intent, such as data exfiltration to unauthorized endpoints or prompt injection against the agent, was found in the provided `SKILL.md`.