ClawHub
Back to skill

Security audit

Agentcast

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it asks users to run live wallet and Farcaster identity operations with raw keys through mutable installs and broad network endpoints.

Review before installing. Use a fresh low-value wallet, run dependency installation in an environment with no secrets loaded, prefer reviewed pinned code and lockfiles, avoid custom hub/RPC URLs unless you trust them, and assume on-chain transactions plus Farcaster profile/linking changes are public and may not be reversible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:5
Finding

Unpinned Dependencies and Mutable Repository Checkout

Content
View full analysis
Remediation
View remediation
npm ci ``` 5. Review dependency lifecycle scripts. Where dependencies do not require them, install using: ```bash npm ci --ignore-scripts ``` 6. Run dependency installation in an environment that does not contain wallet keys, signer keys, API keys, or other sensitive environment variables. 7. Execute wallet-related scripts in an isolated, least-privileged environment and expose only the credentials required for the specific operation. 8. Add automated dependency integrity, vulnerability, and provenance checks to the release process. Review all lockfile changes before merging or publishing a new release. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

md
ich requires the fname to be already registered on `fnames.farcaster.xyz`. Use `register-fname.mjs` instead.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill instructs users to use environment variables for sensitive material such as PRIVATE_KEY and SIGNER_KEY and to make multiple network calls, but it does not declare any explicit tool scope or allowed-tools restrictions. In an agent environment, that omission increases the chance the runtime will grant broader-than-necessary access, enabling unintended exfiltration of secrets or unreviewed outbound requests during skill execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

bash
# By agentId (most reliable)
curl -X POST https://ac.800.works/api/agents/refresh \
  -H "Content-Type: application/json" \
  -d '{"agentId": YOUR_AGENT_ID}'

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The final-step guidance at L291-L295 says 'Do NOT cast during setup' and to cast only after the agent appears on the dashboard. However, earlier instructions tell the user to post a test cast to verify setup (L20-L22), announce with a cast in Path A (L162-L169), verify by posting a test cast in Path B (L195-L199), and post in Path D verification (L267-L269). These instructions directly contradict each other about whether casting should occur before indexing confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to use a raw PRIVATE_KEY and perform live on-chain registration/update transactions, but it does not prominently warn that blockchain actions are irreversible or that mishandling private keys can lead to permanent asset loss and identity compromise. In this context, users may copy sensitive keys into shells or scripts and execute state-changing transactions against a real contract, increasing the risk of accidental exposure or unintended writes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest frames the skill around setting up an agent identity on AgentCast/Farcaster and using the AgentCast dashboard/proxy. However, the code permits overriding the destination with any URL, causing the tool to transmit signed Farcaster messages to an arbitrary remote endpoint unrelated to AgentCast. That general-purpose exfiltration/network forwarding capability is not justified by the stated purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

md
const url = useProxy
    ? AGENTCAST_PROXY
    : "https://api.neynar.com/v2/farcaster/user/verification";

  const headers = { "Content-Type": "application/json" };
  if (!useProxy) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/verify-wallet-on-farcaster.mjs (reported line 152)May include surrounding context.

js
const url = useProxy
    ? AGENTCAST_PROXY
    : "https://api.neynar.com/v2/farcaster/user/verification";

  const headers = { "Content-Type": "application/json" };
  if (!useProxy) {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The dependency uses a caret range, which allows automatic installation of newer minor/patch versions instead of an exact reviewed version. This increases supply-chain risk because a compromised or breaking upstream release could be pulled into future installs without explicit approval; in this skill, the Farcaster and on-chain identity context makes dependency trust more important because these libraries may handle signing, identity, or network interactions.

Content

Scanner excerpt · scripts/package.json (reported line 5)May include surrounding context.

json
"name": "agentcast",
  "type": "module",
  "dependencies": {
    "@farcaster/core": "^0.15.0",
    "viem": "^2.47.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The viem dependency is specified with a caret range, so builds may resolve to different upstream releases over time rather than a single audited version. That creates a real but low-severity supply-chain exposure, especially relevant here because viem is commonly used for blockchain transaction and signing operations where a malicious or vulnerable update could affect on-chain behavior.

Content

Scanner excerpt · scripts/package.json (reported line 6)May include surrounding context.

json
"type": "module",
  "dependencies": {
    "@farcaster/core": "^0.15.0",
    "viem": "^2.47.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/register-fname.mjs:89

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/set-profile.mjs:88

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/verify-wallet-on-farcaster.mjs:69