ClawHub
Back to skill

Security audit

Farcaster Agent

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent Farcaster automation purpose, but it asks for wallet-controlling keys and saves them as plaintext by default.

Install only if you are comfortable giving the referenced code control over a fresh, low-balance wallet and public Farcaster actions. Inspect the external Node source before use, prefer --no-save or secure secret storage, avoid committing credentials.json, and assume anyone who can read the saved credential file can control the wallet and Farcaster account.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Content
### Step 3: Credentials are Saved Automatically

Credentials are automatically saved to:
- `~/.openclaw/farcaster-credentials.json` (if OpenClaw is installed)
- `./credentials.json` (fallback)

**Security Warning:** Credentials are stored as **plain text JSON**. Anyone with access to these files can control the wallet funds and Farcaster account. For production use, implement your own secure storage.
Confidence
98% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
Credentials are automatically saved to:
- `~/.openclaw/farcaster-credentials.json` (if OpenClaw is installed)
- `./credentials.json` (fallback)

**Security Warning:** Credentials are stored as **plain text JSON**. Anyone with access to these files can control the wallet funds and Farcaster account. For production use, implement your own secure storage.
Confidence
98% confidence
Finding
credentials.json

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.