← 返回 Skills 市场
1493
总下载
0
收藏
2
当前安装
1
版本数
在 OpenClaw 中安装
/install unzipped-skill
功能描述
Create Farcaster accounts and post casts autonomously. Official skill from the Farcaster team.
安全使用建议
Do not run this skill or provide private keys or funds until you verify its source and code. Specific checks: (1) Confirm the skill is actually published by the Farcaster team (matching owner ID, slug, or an official homepage) — the manifest and _meta.json currently disagree. (2) Ask for the full source repository; do not install or run scripts that are not included in the skill bundle. (3) Never send funds to an address unless you control the private key; if the skill generates a wallet, ensure you (not the skill or unknown third party) hold the private key. (4) Disable auto-save or use --no-save and store keys in a secure vault/hardware wallet if you must test. (5) Prefer to inspect src/auto-setup.js, src/credentials.js, and any npm dependencies before running npm install. If you cannot validate the code and author identity, treat this skill as untrusted.
功能分析
Type: OpenClaw Skill
Name:
Developer:
Version:
Description: OpenClaw Agent Skill
The skill is classified as suspicious due to its handling of sensitive cryptographic material. It explicitly instructs the agent to generate and store private keys in plain text JSON files (`~/.openclaw/farcaster-credentials.json` or `./credentials.json`), a high-risk practice, even though it includes a security warning in SKILL.md. Additionally, the `npm install` command in SKILL.md executes shell commands to fetch dependencies, whose full implications cannot be assessed without the `package.json` file. There is no clear evidence of intentional malicious behavior like exfiltration to unauthorized endpoints or stealthy actions, but the inherent risks associated with plain-text private key storage and unverified dependencies warrant a 'suspicious' classification.
能力评估
Purpose & Capability
The skill claims to be an 'Official' Farcaster agent and its stated purpose (create accounts, add signers, post casts) matches requiring node/npm. However the package is instruction-only (no runtime code files included) and registry metadata (owner/slug/version) does not match the embedded _meta.json; there is no homepage or authoritative source. The 'official' claim is therefore unverified and potentially misleading.
Instruction Scope
SKILL.md instructs generating wallets, asking the human to send ~$1 to a generated address, and running scripts that expect PRIVATE_KEY/SIGNER_PRIVATE_KEY env vars and src/*.js files. It also instructs automatically saving credentials to ~/.openclaw/farcaster-credentials.json or ./credentials.json in plain text. Those environment variables and file writes are not declared in the skill manifest, and saving private keys in plaintext is explicitly warned as insecure — a high-risk operation for an autonomous skill.
Install Mechanism
Install spec is a shell step: 'cd {baseDir}/.. && npm install'. That is relatively low-risk by itself, but odd because the skill bundle contains no code or package.json; there is no remote download URL or pinned release. The install will only be meaningful if the agent environment already contains the expected repository layout, which is unclear. This mismatch makes behavior unpredictable.
Credentials
The manifest lists no required env vars or credentials, yet the runtime instructions require PRIVATE_KEY, SIGNER_PRIVATE_KEY, and FID (used to sign transactions). The skill saves and loads private keys from disk by default. Requesting and persisting private keys (and asking a user to fund an address) is highly sensitive and not justified by the manifest's declared environment needs.
Persistence & Privilege
The skill will persist wallet credentials to ~/.openclaw/farcaster-credentials.json or ./credentials.json by default (auto-save enabled), storing secrets in plaintext. Although 'always' is false, automatic plaintext storage of private keys in common locations is a significant persistence risk and should be treated as requiring explicit user consent and secure storage alternatives.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install unzipped-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/unzipped-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial public release of farcaster-agent, the official skill from the Farcaster team.
- Enables autonomous creation and management of Farcaster accounts, including FID registration, key management, and posting casts.
- Supports complete setup flow: wallet generation, funding, bridging/swapping, registration, profile setup, and credential management.
- Provides both CLI and programmatic APIs for posting casts and updating profile information.
- Credentials are automatically saved for convenience; warning provided about plain text storage.
- Includes comprehensive documentation, prerequisites, full usage guides, error handling, and sample code snippets.
元数据
常见问题
Unzipped Skill 是什么？
Create Farcaster accounts and post casts autonomously. Official skill from the Farcaster team. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1493 次。
如何安装 Unzipped Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install unzipped-skill」即可一键安装，无需额外配置。
Unzipped Skill 是免费的吗？
是的，Unzipped Skill 完全免费（开源免费），可自由下载、安装和使用。
Unzipped Skill 支持哪些平台？
Unzipped Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Unzipped Skill？
由 Jozh-bit（@jozh-bit）开发并维护，当前版本 v1.0.0。
推荐 Skills