AI Dating - Making Friends or Finding a Partner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:20 PM UTC
• Version: 1.3.1

Overview

This skill has a coherent dating-API purpose, but it sends very sensitive profile, photo, contact, and credential data to an external service with weak update and temporary-file safeguards.

Install only if you intentionally want Codex to use this third-party dating backend. Confirm the base URL and privacy terms first, do not use example credentials, avoid optional contact or exact-location fields unless needed, and treat generated tokens, task IDs, photos, and revealed contact details as sensitive. Prefer a reviewed pinned update path and secure temporary-file handling before production or workplace use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35
• Finding: Unpinned Third-Party Skill Update Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35-39 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ## Update Commands When users ask to update this skill, run: npx skills add 1asdwz/ai-dating ``` ### Technical Analysis The documented update process uses `npx` to install a Skill from a mutable third-party repository reference. The command does not specify a reviewed version, immutable commit hash, package integrity hash, or cryptographic signature. Consequently, the content installed by this command can differ from the content covered by this audit. Compromise of the upstream account, repository, package-resolution infrastructure, or a subsequent malicious update could introduce unauthorized instructions or executable content. Although the current artifact does not contain embedded malicious scripts, its recommended update mechanism crosses a supply-chain trust boundary without integrity verification. ### Attack Path 1. An attacker compromises the upstream `1asdwz/ai-dating` project, its maintainer account, or a relevant package-resolution channel. 2. The attacker publishes modified Skill content under the same mutable reference. 3. A user asks the agent to update the Skill. 4. The agent executes `npx skills add 1asdwz/ai-dating` as documented. 5. The command retrieves and installs content that was not part of the reviewed artifact. 6. The newly installed Skill can subsequently influence agent behavior or execute any functionality supported by the Skill framework. ### Impact Assessment Successful exploitation could replace the audited Skill with attacker-controlled content. The resulting impact depends on the privileges of the installation process and agent runtime, but may include: - Unauthorized modification of agent instructions. - Exposure of dating credentials, authentication tokens, profile details, photographs, and contact information. - Unauth ...[truncated 359 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the Skill source to a reviewed immutable release or commit hash. - Pin the `npx` installer package itself to an approved version. - Require integrity verification through a checksum or cryptographic signature. - Download updates into a staging directory and review their complete contents before activation. - Compare the downloaded artifact against an approved manifest of expected files. - Run installation with the minimum required privileges. - Prevent updates from automatically replacing an active Skill without explicit confirmation. - Document a rollback procedure and preserve the last verified version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:91
• Finding: Predictable Request File Can Retain Plaintext Credentials and Personal Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 91-96; related sensitive writes at lines 112-123 **Vulnerability Type**: Unsafe temporary-file handling and plaintext sensitive-data retention **Risk Level**: Medium ### Vulnerable Code ```bash BODY_PATH="$(pwd)/.tmp_dating_body.json" AUTH="" TASK_ID="" MATCH_ID="" ``` The fixed file is later used for sensitive request bodies, including credentials: ```bash cat > "$BODY_PATH" <<'JSON' {"username":"amy_2026","password":"123456"} JSON LOGIN_RESP=$(curl -sS -X POST "$BASE_URL/login" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH") ``` The same path is also reused for profile payloads containing fields such as email addresses, phone numbers, social handles, detailed location information, and photograph URLs. ### Technical Analysis The workflow writes request bodies to a predictable file named `.tmp_dating_body.json` in the current working directory. It does not: - Create the file atomically. - Enforce owner-only permissions. - Verify that the path is not a symbolic link. - Remove the file after use. - Register a cleanup handler for failures or interrupted sessions. The user's effective `umask` determines the resulting permissions. In a shared or permissively configured environment, another local user or process may be able to read the file. Because the path is predictable, an attacker with write access to the working directory could also pre-create it as a symbolic link, causing shell redirection to overwrite another file writable by the agent. The issue is particularly sensitive because the file can contain account passwords and substantial personally identifiable information. ### Attack Path #### Plaintext disclosure 1. The workflow writes login credentials or profile information to `.tmp_dating_body.json`. 2. The file remains in the project directory after the HTTP request completes. 3. Another local user, process, backup system, indexing service, or la ...[truncated 1228 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use a securely created temporary file with restrictive permissions and guaranteed cleanup: ```bash umask 077 BODY_PATH="$(mktemp "${TMPDIR:-/tmp}/ai-dating-body.XXXXXX")" || exit 1 trap 'rm -f -- "$BODY_PATH"' EXIT HUP INT TERM ``` Additional hardening measures should include: - Never use a predictable file in the current working directory for secrets. - Confirm that temporary files are regular files and are owned by the current user. - Avoid storing credentials on disk where possible; send generated request data directly to `curl` through standard input. - Clear or replace a sensitive request body immediately after the corresponding request. - Keep authentication tokens and responses out of logs and shell tracing. - Run the workflow in a private working directory inaccessible to other users. - Document that temporary files may contain sensitive personal data and must not be committed, backed up, or indexed. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:117
• Finding: Weak Example Password May Be Reused as an Operational Credential<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 117-123 **Vulnerability Type**: Insecure example credential **Risk Level**: Low ### Vulnerable Code ```bash cat > "$BODY_PATH" <<'JSON' {"username":"amy_2026","password":"123456"} JSON LOGIN_RESP=$(curl -sS -X POST "$BASE_URL/login" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH") ``` ### Technical Analysis The workflow provides `123456` as a complete password in an immediately executable login example. This is a commonly guessed password and provides negligible resistance to password guessing. Because the document describes these commands as full parameter examples, an agent or user may copy the value directly rather than replacing it with a strong credential. The instructions do not explicitly prohibit reuse of example credentials or require a unique, securely generated password. The value does not appear to be a secret belonging to the project. The risk arises from presenting a weak literal value in an operational authentication workflow. ### Attack Path 1. A user or agent follows the example without replacing the password. 2. The dating account is configured with, or already uses, `123456`. 3. An attacker identifies or guesses the username. 4. The attacker attempts common passwords against the login endpoint. 5. The backend accepts `123456`, granting the attacker an authenticated session. This path depends on the example value being used as a real credential and the backend accepting it. ### Impact Assessment Successful exploitation could grant access to the affected dating account. Depending on backend authorization and available endpoints, the attacker may be able to: - Access or modify profile information. - View sensitive personal attributes and matchmaking preferences. - Create, update, or stop matchmaking tasks. - Inspect candidate information. - Use authenticated account functionality to reveal contact details. - Submit actions or reviews as ...[truncated 101 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the literal password with an unmistakable placeholder: ```json {"username":"<USER_SUPPLIED_USERNAME>","password":"<STRONG_USER_SUPPLIED_PASSWORD>"} ``` - Explicitly state that example values must never be used as real credentials. - Require a unique password generated by a password manager or cryptographically secure generator. - Avoid placing real passwords directly into reusable documentation. - If the API supports registration-generated credentials, display them only once and instruct the user to store them securely. - Recommend rate limiting, account lockout protections, and multi-factor authentication at the backend level where supported. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Self-Modification

High

• Category: Rogue Agent

Content

## Update Commands

When users ask to update this skill, run:

```bash
npx skills add 1asdwz/ai-dating

• Confidence: 96% confidence
• Finding: The skill contains self-modification instructions that tell the agent to update the skill from a remote source. Allowing a skill to direct its own upgrade path is dangerous because it can bypass normal review expectations and combine with the unpinned `npx` fetch to introduce changed or malicious behavior later.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill's trigger list is broad and maps to common, ambiguous user intents like 'make friends' or 'find a partner', which increases the chance the agent invokes an external dating workflow without the user realizing their personal data will be sent to a third-party service. In this context, the risk is amplified because the skill performs networked actions involving profile traits, photos, and contact details, so accidental activation can cause privacy-impacting disclosures rather than a harmless local action.

External Transmission

Medium

• Category: Data Exfiltration

Content

---
name: ai-dating
description: "Direct dating and matchmaking workflow via curl against the dating HTTP API. Use when users ask to make friends, find a partner, date, run matchmaking, xiangqin, update a dating profile, upload profile photos, create or update a match task, check candidates, reveal contact details, or submit reviews."
license: MIT
metadata:
  author: 1asdwz

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to send user data to an external dating API, including profile data, match preferences, photos, and later contact details. Even though the document includes some consent guidance, the data category is extremely sensitive, and transmission to a third-party matchmaking backend materially increases privacy, compliance, and misuse risk if invoked in error or used in an unapproved environment.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The top-level description uses broad everyday phrases like making friends, dating, uploading photos, and revealing contact details, which can cause the agent to invoke the skill in situations where the user may only want advice. In this skill, mistaken invocation is especially risky because it can lead to transmission of highly sensitive personal, location, photo, and contact data to an external service.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger conditions are ambiguous about when the skill should actually execute versus when it should only help draft preferences locally. Because the workflow performs account actions and uploads sensitive data to a third-party service, ambiguous triggers increase the chance of unauthorized or premature external requests.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs users to run `npx skills add 1asdwz/ai-dating` without pinning an exact version or commit. That allows the fetched package or skill contents to change over time, creating a supply-chain risk where a later malicious or compromised update could execute different code or alter the skill behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
JSON

curl -sS -X PUT "$BASE_URL/member-profile" \
  -H "Authorization: $AUTH" \
  -H "Content-Type: application/json" \
  --data-binary @"$BODY_PATH"

• Confidence: 98% confidence
• Finding: The profile update example sends a very broad set of sensitive personal data in one request, including birthday, exact location, email, phone, multiple social handles, and photo URLs. In a dating-skill context this is especially dangerous because it centralizes enough information for doxxing, stalking, account correlation, impersonation, or broader privacy harm if the backend is compromised, misused, or invoked without carefully scoped consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
JSON

curl -sS -X POST "$BASE_URL/match-tasks/$TASK_ID/update" \
  -H "Authorization: $AUTH" \
  -H "Content-Type: application/json" \
  --data-binary @"$BODY_PATH"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The guidance explicitly tells operators to keep authentication-derived session state (`AUTH`) and task identifiers, but it does not pair that with limits on storage duration, secure handling, redaction, or cleanup. In a dating workflow, those values are sensitive because they can enable continued access to a user's account context and matchmaking data if logged, persisted in shell history, temp files, transcripts, or shared debugging output.

External Transmission

Medium

• Category: Data Exfiltration

Content

{"username":"amy_2026"}
JSON

RESP=$(curl -sS -X POST "$BASE_URL/register" \
  -H "Content-Type: application/json" \
  --data-binary @"$BODY_PATH")
```

• Confidence: 88% confidence
• Finding: This step sends user registration data to an external service and the documented response includes highly sensitive secrets such as a generated password and bearer token. Even though external transmission is core to the skill, it is still security-relevant because the workflow normalizes sending personal data to a third-party dating backend and handling returned credentials without strong safeguards around exposure, logging, or secret lifecycle.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
JSON

TASK_RESP=$(curl -sS -X POST "$BASE_URL/match-tasks" \
  -H "Authorization: $AUTH" \
  -H "Content-Type: application/json" \
  --data-binary @"$BODY_PATH")

• Confidence: 82% confidence
• Finding: Creating a match task transmits intimate preference and profiling data to an external backend, including demographic filters, hobbies, personality traits, and relationship intention. In the dating context this data is especially sensitive because it can reveal sexual/romantic preferences, location constraints, and behavioral profiling inputs, creating privacy and misuse risks if shared without clear consent and minimization.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
JSON

curl -sS -X POST "$BASE_URL/match-tasks/$TASK_ID/update" \
  -H "Authorization: $AUTH" \
  -H "Content-Type: application/json" \
  --data-binary @"$BODY_PATH"

• Confidence: 80% confidence
• Finding: Updating a match task again sends sensitive preference data to the external backend and the surrounding guidance encourages retaining the task ID because there is no list endpoint. The transmission itself is expected functionality, but in combination with persistent identifiers and intimate criteria it increases the chance of long-lived tracking, replay, or leakage of a user's dating preferences.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill provides direct steps to reveal another user's contact information and enumerates the returned fields, but it does not impose clear disclosure controls such as consent verification, purpose limitation, minimum-necessary display, or prohibitions on re-sharing. In a dating context, contact details are highly sensitive and misuse can lead to stalking, harassment, deanonymization, or off-platform abuse.

Static analysis

No suspicious patterns detected.