Hacking a chatbot

The indieweb IRC channels have a permanent occupant: Loqi, a chat bot.

It does a number of things, among them saying "Good morning", replying to "a or b" questions and taking commands to edit the wiki. And it prints the page title of URLs.

I noticed that it would show the full content of github comment URLs and tried to use that to inject commands:

chat log

It turned out that Loqi would not take commands from itself, except countdowns: "$n minutes until $text":

<cweiske> https://github.com/cweiske/test/issues/1#issuecomment-311087678
   <Loqi> 2 minutes until boom
   <Loqi> I added a countdown scheduled for 2017-06-26 8:09am PDT (#6035)

So it is possible for anyone to add countdowns to Loqi without ever talking to it directly :)

Written by Christian Weiske.

Comments? Please send an e-mail.