Security audit

OpenClaw Social Post

Security checks for vulnerabilities and agentic risk

Overview

This is a real social-posting skill, but it needs Review because it can post unexpectedly and gives unsafe local code access to powerful social and wallet credentials.

Install only if you are comfortable granting public posting authority and Farcaster wallet signing authority to shell scripts and external helper code. Prefer waiting for fixes that remove the Twitter write-endpoint tier probe, stop sourcing .env as shell, verify or vendor external helpers, use safer secret storage, and clearly disclose all image and link destinations.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: lib/tier-detection.sh:87
Finding: <![CDATA[Twitter tier detection can publish an unauthorized tweet before confirmation]]>
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/twitter.sh:6
Finding: <![CDATA[Credential files are executed as arbitrary shell code]]>
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: lib/farcaster.sh:53
Finding: <![CDATA[Sensitive credentials and wallet signing authority are delegated to unverified external code]]>
Content: View full analysis
{ const baseProvider = new JsonRpcProvider('https://mainnet.base.org'); const wallet = new Wallet(process.env.PRIVATE_KEY, baseProvider); const signerBytes = Buffer.from(process.env.SIGNER_PRIVATE_KEY, 'hex'); const signer = new NobleEd25519Signer(signerBytes); const fid = parseInt(process.env.FID); const parentHashBytes = Buffer.from(process.env.PARENT_HASH.replace('0x', ''), 'hex'); const castResult = await makeCastAdd({ text, embeds: [], embedsDeprecated: [], mentions: [], mentionsPositions: [], parentCastId: { fid, hash: parentHashBytes } }, { fid, network: FarcasterNetwork.MAINNET }, signer); if (castResult.isErr()) throw new Error('Failed: ' + castResult.error); const cast = castResult.value; const hash = '0x' + Buffer.from(cast.hash).toString('hex'); const messageBytes = Buffer.from(Message.encode(cast).finish()); await submitMessage(wallet, messageBytes); await new Promise(r => setTimeout(r, 2000)); console.log('Cast hash:', hash); console.log('URL: https://farcaster.xyz/~/conversations/' + hash); })().catch(err => { console.error('Error:', err. ...[truncated 2446 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lib/links.sh:4
Finding: <![CDATA[Link shortening transmits complete URLs over plaintext HTTP]]>
Content: View full analysis
Remediation: View remediation

other

Warning

Location: lib/farcaster.sh:85
Finding: <![CDATA[Farcaster image uploads disclose files to anonymous third-party hosting services]]>
Content: View full analysis
&2 return 1 fi # Try catbox.moe (no API key needed, reliable) local response=$(curl -s -F "reqtype=fileupload" -F "fileToUpload=@$image_path" https://catbox.moe/user/api.php) if [[ "$response" =~ ^https://files.catbox.moe/ ]]; then echo "$response" return 0 fi # Fallback: try uguu.se response=$(curl -s -F "files[]=@$image_path" https://uguu.se/upload.php | jq -r '.files[0].url' 2>/dev/null) if [[ "$response" =~ ^https:// ]]; then echo "$response" return 0 fi echo "Error: Failed to upload image" >&2 return 1 } ``` ### Technical Analysis When posting an image to Farcaster, the Skill sends the selected local file to Catbox. If that upload does not produce the expected response, it automatically sends the same file to Uguu. The fallback transfer occurs without a separate confirmation and the main Skill documentation identifies Catbox as the Farcaster image host without clearly identifying Uguu as an additional possible recipient. Files may also contain EXIF, GPS, device, timestamp, or author metadata that the Skill does not strip before uploading. Although remote image hosting is functionally necessary for this implementation's Farcaster embeds, automatically trying multiple third-party services exceeds the minimum disclosure needed unless all destinations are clearly disclosed and approved. ### Attack Path 1. The user selects a local image for a Farcaster post or reply. 2. The user approves the social posting operation. 3. The Skill uploads the image to Catbox. 4. If Catbox fails or returns an unexpected response, the Skill au ...[truncated 541 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (114)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation directly states that the feature bypasses Twitter anti-spam duplicate-content protections. A skill that markets or supports defeating abuse protections materially increases misuse potential for spam, coordinated amplification, and account network abuse.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The Quick Reference table discloses exact local credential storage locations for both platforms. In isolation this is mild, but in an agent ecosystem it meaningfully lowers the effort for any compromised tool, prompt-injected agent, or local attacker to target known secret paths.
Content: Scanner excerpt · README.md (reported line 47)May include surrounding context.
md
| Platform | Cost | Credentials Location | Setup Time | |----------|------|---------------------|------------| | **X/Twitter** | Pay-per-use (consumption-based) | `~/.openclaw/.env` | 5-10 min | | **Farcaster** | 0.001 USDC/cast | `~/.openclaw/farcaster-credentials.json` | 15-20 min | **Before first use:** 1. Set up credentials for your platforms (see below)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 91)May include surrounding context.
md
**Step 2: Create App & Generate Keys** 1. Create a new App in Developer Portal 2. Set permissions to "Read and Write" 3. Generate Consumer Key/Secret and Access Token/Secret **Step 3: Add to .env file** Location: `/home/phan_harry/.openclaw/.env`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
**Step 2: Create App & Generate Keys** 1. Create a new App in Developer Portal 2. Set permissions to "Read and Write" 3. Generate Consumer Key/Secret and Access Token/Secret **Step 3: Add to .env file** Location: `/home/phan_harry/.openclaw/.env`

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The X setup section gives the exact .env path and instructs users to place API secrets there. While common, this exposes a predictable location for credential theft in environments where multiple skills or agents may access the same home directory.
Content: Scanner excerpt · README.md (reported line 93)May include surrounding context.

Set permissions to "Read and Write"

Generate Consumer Key/Secret and Access Token/Secret

Step 3: Add to .env file Location: /home/phan_harry/.openclaw/.env

bash
X_CONSUMER_KEY=your_consumer_key

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The README explicitly states that another skill will save Farcaster credentials to ~/.openclaw/farcaster-credentials.json, advertising the location of wallet- and signer-related secrets. Because those credentials include private keys capable of spending funds and posting as the user, path disclosure increases the blast radius of any other local compromise.
Content: Scanner excerpt · README.md (reported line 125)May include surrounding context.
This will automatically:

- Register your FID

- Add signer key

- Save credentials to ~/.openclaw/farcaster-credentials.json

text
Option B - Use existing account:

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The sample credentials JSON includes fields for custodyPrivateKey and signerPrivateKey, which are highly sensitive and directly security-relevant. Even though the values are truncated examples, documenting the exact schema in plaintext encourages storage and manual handling of secrets that could enable account takeover or wallet abuse if exposed.
Content: Scanner excerpt · README.md (reported line 135)May include surrounding context.
Step 2: Verify Credentials File

Location: /home/phan_harry/.openclaw/farcaster-credentials.json

json
{ "fid": "2684290",

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: The README tells users to query ~/.openclaw/.env and ~/.openclaw/farcaster-credentials.json directly to verify setup. In an agent-oriented environment, repeatedly identifying these exact secret locations increases the chance that another component targets them for exfiltration or misuse.
Content: Scanner excerpt · README.md (reported line 182)May include surrounding context.
1. Check credentials exist:

bash
# Check X/Twitter credentials grep "^X_CONSUMER_KEY" ~/.openclaw/.env # Check Farcaster credentials ls -la ~/.openclaw/farcaster-credentials.json

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The verification step directs users to inspect the presence of the Farcaster credentials file at a known location. In a security-sensitive skill that handles private keys, documentation that normalizes direct interaction with secret files increases the risk of accidental disclosure and makes those files easier targets for malicious local tooling.
Content: Scanner excerpt · README.md (reported line 185)May include surrounding context.
grep "^X_CONSUMER_KEY" ~/.openclaw/.env

Check Farcaster credentials

ls -la ~/.openclaw/farcaster-credentials.json

text
**2. Check Farcaster wallet balance:**

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: Troubleshooting for .env again discloses the precise secret file path and encourages direct interaction with the file. That is risky because it can lead to accidental display of tokens and makes credential targeting easier for any adversarial local process or prompt-injected agent.
Content: Scanner excerpt · README.md (reported line 313)May include surrounding context.

Check .env file exists: ls -la ~/.openclaw/.env

Verify credentials are set:
bash
grep "^X_" ~/.openclaw/.env

Ensure no extra spaces or quotes around values

Check file permissions: chmod 600 ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: Troubleshooting guidance again points users to the exact Farcaster credential file path and suggests validating it with jq, which can encourage opening and handling a file that contains private keys. This increases the chance of accidental exposure in terminals, logs, screen shares, or agent-collected command history.
Content: Scanner excerpt · README.md (reported line 323)May include surrounding context.
text
**"Error: Farcaster credentials not found"** 1. Check file exists: `ls -la ~/.openclaw/farcaster-credentials.json` 2. Verify JSON is valid: ```bash jq . ~/.openclaw/farcaster-credentials.json

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The README enumerates required fields including custodyPrivateKey and signerPrivateKey, emphasizing that raw private keys are part of the expected operational setup. In context, these are powerful secrets tied to identity and funds, so normalized plaintext key management is a real security concern, not just a documentation detail.
Content: Scanner excerpt · README.md (reported line 326)May include surrounding context.

Check file exists: ls -la ~/.openclaw/farcaster-credentials.json

Verify JSON is valid:
bash
jq . ~/.openclaw/farcaster-credentials.json

Ensure all required fields present:

fid, custodyAddress, custodyPrivateKey

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill is presented as a posting tool, but the analyzed behavior reportedly includes local credential reads and blockchain balance checks not clearly foregrounded in the main description. Hidden or underemphasized resource access is security-relevant because it expands the trust boundary beyond what a user expects when enabling a 'social posting' skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a posting tool, but the analyzed behavior reportedly includes local credential reads and blockchain balance checks not clearly foregrounded in the main description. Hidden or underemphasized resource access is security-relevant because it expands the trust boundary beyond what a user expects when enabling a 'social posting' skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a posting tool, but the analyzed behavior reportedly includes local credential reads and blockchain balance checks not clearly foregrounded in the main description. Hidden or underemphasized resource access is security-relevant because it expands the trust boundary beyond what a user expects when enabling a 'social posting' skill.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The instructions direct users to place live API secrets in a plaintext .env file under the home directory. This is a common but risky pattern because local compromise, accidental backups, permissive file permissions, or tool overreach can expose credentials that enable account takeover or abuse.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Access Token & Secret: Click "Generate" under "Authentication Tokens"

Save all 4 credentials securely

Add to .env file
bash
echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The documented storage of consumer and access secrets in ~/.openclaw/.env exposes powerful API credentials to any process or actor that can read that file. In an agent ecosystem with shell and file capabilities, plaintext credential storage substantially increases blast radius.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

Add to .env file
bash
echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Access tokens stored in plaintext are directly usable to post or act on behalf of the account if disclosed. Because this skill automates public actions, leaked tokens could be immediately abused for spam, impersonation, or reputational damage.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

Add to .env file
bash
echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Storing token secrets in ~/.openclaw/.env is sensitive because these secrets are sufficient to authenticate write operations to external social APIs. Any unintended read access by other skills, logs, or system users could enable account compromise.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
bash
echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 81% confidence
Finding: The general instruction to append secrets into a home-directory .env file reinforces insecure secret-handling practices. While documentation itself is not exploitation, it normalizes a storage pattern that weakens overall credential hygiene in the deployment environment.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

text
**Test your credentials:**

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Multi-account support multiplies the number of plaintext credentials stored in one file, increasing the impact of a single file disclosure. A compromise would expose multiple social identities at once, making abuse and recovery more severe.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
bash
# Add credentials with custom prefix (e.g., MYACCOUNT_) echo "MYACCOUNT_API_KEY=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_API_KEY_SECRET=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Additional API key secrets for multiple accounts expand the secret surface and account-compromise blast radius. In a skill with shell/file capabilities, consolidated plaintext secret storage is particularly risky.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
bash
# Add credentials with custom prefix (e.g., MYACCOUNT_) echo "MYACCOUNT_API_KEY=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_API_KEY_SECRET=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Documented plaintext storage of multiple access tokens creates a straightforward target for exfiltration. Because these tokens enable public posting, misuse could impact several brands or personas simultaneously.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
Add credentials with custom prefix (e.g., MYACCOUNT_)

echo "MYACCOUNT_API_KEY=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_API_KEY_SECRET=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

text

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: Persisting multiple token secrets in a shared .env file increases exposure and operational risk. This is especially dangerous in environments where several skills may have broad filesystem access or where backups/logs include home-directory artifacts.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
echo "MYACCOUNT_API_KEY=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_API_KEY_SECRET=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "MYACCOUNT_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

text
**Usage:**

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill depends on reading a local JSON file containing Farcaster private keys and wallet information. Handling plaintext long-lived credentials is inherently sensitive; compromise of the skill, its execution environment, or logs could lead to account takeover and financial loss from wallet misuse.
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
Farcaster Setup

Required credentials (stored in /home/phan_harry/.openclaw/farcaster-credentials.json):

json
{ "fid": "your_farcaster_id",

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T07 · Tool Hijacking and Spoofing

T09 · Insecure Skill Coding Practices

other

SkillSpector

Natural-Language Policy Violations

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

This will automatically:

- Register your FID

- Add signer key

- Save credentials to ~/.openclaw/farcaster-credentials.json

Credential Access

Credential Access

Credential Access

Check Farcaster credentials

Credential Access

Credential Access

Credential Access

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Add credentials with custom prefix (e.g., MYACCOUNT_)

Credential Access

Credential Access

Farcaster Setup

Static analysis