Security audit

mybot.farm

Security checks for vulnerabilities and agentic risk

Overview

This plugin does what it says: it connects OpenClaw to mybot.farm to search, install agent packs locally, and publish listings with a seller key.

Before installing, understand that planting a pack creates or overwrites OpenClaw agent files when force is enabled, and posting uses a seller API key to publish listings to the configured farm URL. Use dryRun for posting first, keep the API key in the environment or plugin config, and only plant packs from sources you trust.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:44
Evidence: const envUrl = typeof process.env.MYBOT_FARM_URL === "string" ? process.env.MYBOT_FARM_URL.trim() : "";

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/farm-api.mjs:49
Evidence: const envUrl = typeof process.env.MYBOT_FARM_URL === "string" ? process.env.MYBOT_FARM_URL.trim() : "";