← Back to Skills Marketplace
1493
Downloads
0
Stars
2
Active Installs
1
Versions
Install in OpenClaw
/install unzipped-skill
Description
Create Farcaster accounts and post casts autonomously. Official skill from the Farcaster team.
Usage Guidance
Do not run this skill or provide private keys or funds until you verify its source and code. Specific checks: (1) Confirm the skill is actually published by the Farcaster team (matching owner ID, slug, or an official homepage) — the manifest and _meta.json currently disagree. (2) Ask for the full source repository; do not install or run scripts that are not included in the skill bundle. (3) Never send funds to an address unless you control the private key; if the skill generates a wallet, ensure you (not the skill or unknown third party) hold the private key. (4) Disable auto-save or use --no-save and store keys in a secure vault/hardware wallet if you must test. (5) Prefer to inspect src/auto-setup.js, src/credentials.js, and any npm dependencies before running npm install. If you cannot validate the code and author identity, treat this skill as untrusted.
Capability Analysis
Type: OpenClaw Skill
Name:
Developer:
Version:
Description: OpenClaw Agent Skill
The skill is classified as suspicious due to its handling of sensitive cryptographic material. It explicitly instructs the agent to generate and store private keys in plain text JSON files (`~/.openclaw/farcaster-credentials.json` or `./credentials.json`), a high-risk practice, even though it includes a security warning in SKILL.md. Additionally, the `npm install` command in SKILL.md executes shell commands to fetch dependencies, whose full implications cannot be assessed without the `package.json` file. There is no clear evidence of intentional malicious behavior like exfiltration to unauthorized endpoints or stealthy actions, but the inherent risks associated with plain-text private key storage and unverified dependencies warrant a 'suspicious' classification.
Capability Assessment
Purpose & Capability
The skill claims to be an 'Official' Farcaster agent and its stated purpose (create accounts, add signers, post casts) matches requiring node/npm. However the package is instruction-only (no runtime code files included) and registry metadata (owner/slug/version) does not match the embedded _meta.json; there is no homepage or authoritative source. The 'official' claim is therefore unverified and potentially misleading.
Instruction Scope
SKILL.md instructs generating wallets, asking the human to send ~$1 to a generated address, and running scripts that expect PRIVATE_KEY/SIGNER_PRIVATE_KEY env vars and src/*.js files. It also instructs automatically saving credentials to ~/.openclaw/farcaster-credentials.json or ./credentials.json in plain text. Those environment variables and file writes are not declared in the skill manifest, and saving private keys in plaintext is explicitly warned as insecure — a high-risk operation for an autonomous skill.
Install Mechanism
Install spec is a shell step: 'cd {baseDir}/.. && npm install'. That is relatively low-risk by itself, but odd because the skill bundle contains no code or package.json; there is no remote download URL or pinned release. The install will only be meaningful if the agent environment already contains the expected repository layout, which is unclear. This mismatch makes behavior unpredictable.
Credentials
The manifest lists no required env vars or credentials, yet the runtime instructions require PRIVATE_KEY, SIGNER_PRIVATE_KEY, and FID (used to sign transactions). The skill saves and loads private keys from disk by default. Requesting and persisting private keys (and asking a user to fund an address) is highly sensitive and not justified by the manifest's declared environment needs.
Persistence & Privilege
The skill will persist wallet credentials to ~/.openclaw/farcaster-credentials.json or ./credentials.json by default (auto-save enabled), storing secrets in plaintext. Although 'always' is false, automatic plaintext storage of private keys in common locations is a significant persistence risk and should be treated as requiring explicit user consent and secure storage alternatives.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install unzipped-skill - After installation, invoke the skill by name or use
/unzipped-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial public release of farcaster-agent, the official skill from the Farcaster team.
- Enables autonomous creation and management of Farcaster accounts, including FID registration, key management, and posting casts.
- Supports complete setup flow: wallet generation, funding, bridging/swapping, registration, profile setup, and credential management.
- Provides both CLI and programmatic APIs for posting casts and updating profile information.
- Credentials are automatically saved for convenience; warning provided about plain text storage.
- Includes comprehensive documentation, prerequisites, full usage guides, error handling, and sample code snippets.
Metadata
Frequently Asked Questions
What is Unzipped Skill?
Create Farcaster accounts and post casts autonomously. Official skill from the Farcaster team. It is an AI Agent Skill for Claude Code / OpenClaw, with 1493 downloads so far.
How do I install Unzipped Skill?
Run "/install unzipped-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Unzipped Skill free?
Yes, Unzipped Skill is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Unzipped Skill support?
Unzipped Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Unzipped Skill?
It is built and maintained by Jozh-bit (@jozh-bit); the current version is v1.0.0.
More Skills