T08 · Insecure Dependencies
Warning
- Location
SKILL.md:35- Finding
Unpinned Third-Party Skill Update Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Dating - Making Friends or Finding a Partner
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent dating-API purpose, but it sends very sensitive profile, photo, contact, and credential data to an external service with weak update and temporary-file safeguards.
Install only if you intentionally want Codex to use this third-party dating backend. Confirm the base URL and privacy terms first, do not use example credentials, avoid optional contact or exact-location fields unless needed, and treat generated tokens, task IDs, photos, and revealed contact details as sensitive. Prefer a reviewed pinned update path and secure temporary-file handling before production or workplace use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:91- Finding
Predictable Request File Can Retain Plaintext Credentials and Personal Data
- Content
View full analysis
"$BODY_PATH" <<'JSON' {"username":"amy_2026","password":"123456"} JSON LOGIN_RESP=$(curl -sS -X POST "$BASE_URL/login" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH") ``` The same path is also reused for profile payloads containing fields such as email addresses, phone numbers, social handles, detailed location information, and photograph URLs. ### Technical Analysis The workflow writes request bodies to a predictable file named `.tmp_dating_body.json` in the current working directory. It does not: - Create the file atomically. - Enforce owner-only permissions. - Verify that the path is not a symbolic link. - Remove the file after use. - Register a cleanup handler for failures or interrupted sessions. The user's effective `umask` determines the resulting permissions. In a shared or permissively configured environment, another local user or process may be able to read the file. Because the path is predictable, an attacker with write access to the working directory could also pre-create it as a symbolic link, causing shell redirection to overwrite another file writable by the agent. The issue is particularly sensitive because the file can contain account passwords and substantial personally identifiable information. ### Attack Path #### Plaintext disclosure 1. The workflow writes login credentials or profile information to `.tmp_dating_body.json`. 2. The file remains in the project directory after the HTTP request completes. 3. Another local user, process, backup system, indexing service, or la ...[truncated 1228 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:117- Finding
Weak Example Password May Be Reused as an Operational Credential
- Content
View full analysis
"$BODY_PATH" <<'JSON' {"username":"amy_2026","password":"123456"} JSON LOGIN_RESP=$(curl -sS -X POST "$BASE_URL/login" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH") ``` ### Technical Analysis The workflow provides `123456` as a complete password in an immediately executable login example. This is a commonly guessed password and provides negligible resistance to password guessing. Because the document describes these commands as full parameter examples, an agent or user may copy the value directly rather than replacing it with a strong credential. The instructions do not explicitly prohibit reuse of example credentials or require a unique, securely generated password. The value does not appear to be a secret belonging to the project. The risk arises from presenting a weak literal value in an operational authentication workflow. ### Attack Path 1. A user or agent follows the example without replacing the password. 2. The dating account is configured with, or already uses, `123456`. 3. An attacker identifies or guesses the username. 4. The attacker attempts common passwords against the login endpoint. 5. The backend accepts `123456`, granting the attacker an authenticated session. This path depends on the example value being used as a real credential and the backend accepting it. ### Impact Assessment Successful exploitation could grant access to the affected dating account. Depending on backend authorization and available endpoints, the attacker may be able to: - Access or modify profile information. - View sensitive personal attributes and matchmaking preferences. - Create, update, or stop matchmaking tasks. - Inspect candidate information. - Use authenticated account functionality to reveal contact details. - Submit actions or reviews as ...[truncated 101 chars]- Remediation
View remediation
","password":""} ``` - Explicitly state that example values must never be used as real credentials. - Require a unique password generated by a password manager or cryptographically secure generator. - Avoid placing real passwords directly into reusable documentation. - If the API supports registration-generated credentials, display them only once and instruct the user to store them securely. - Recommend rate limiting, account lockout protections, and multi-factor authentication at the backend level where supported. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The skill contains self-modification instructions that tell the agent to update the skill from a remote source. Allowing a skill to direct its own upgrade path is dangerous because it can bypass normal review expectations and combine with the unpinned
npxfetch to introduce changed or malicious behavior later.- Content
Update Commands
When users ask to update this skill, run:
bash npx skills add 1asdwz/ai-dating
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill's trigger list is broad and maps to common, ambiguous user intents like 'make friends' or 'find a partner', which increases the chance the agent invokes an external dating workflow without the user realizing their personal data will be sent to a third-party service. In this context, the risk is amplified because the skill performs networked actions involving profile traits, photos, and contact details, so accidental activation can cause privacy-impacting disclosures rather than a harmless local action.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill is explicitly designed to send user data to an external dating API, including profile data, match preferences, photos, and later contact details. Even though the document includes some consent guidance, the data category is extremely sensitive, and transmission to a third-party matchmaking backend materially increases privacy, compliance, and misuse risk if invoked in error or used in an unapproved environment.
- Content
md --- name: ai-dating description: "Direct dating and matchmaking workflow via curl against the dating HTTP API. Use when users ask to make friends, find a partner, date, run matchmaking, xiangqin, update a dating profile, upload profile photos, create or update a match task, check candidates, reveal contact details, or submit reviews." license: MIT metadata: author: 1asdwz
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level description uses broad everyday phrases like making friends, dating, uploading photos, and revealing contact details, which can cause the agent to invoke the skill in situations where the user may only want advice. In this skill, mistaken invocation is especially risky because it can lead to transmission of highly sensitive personal, location, photo, and contact data to an external service.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions are ambiguous about when the skill should actually execute versus when it should only help draft preferences locally. Because the workflow performs account actions and uploads sensitive data to a third-party service, ambiguous triggers increase the chance of unauthorized or premature external requests.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The skill instructs users to run
npx skills add 1asdwz/ai-datingwithout pinning an exact version or commit. That allows the fetched package or skill contents to change over time, creating a supply-chain risk where a later malicious or compromised update could execute different code or alter the skill behavior.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
The profile update example sends a very broad set of sensitive personal data in one request, including birthday, exact location, email, phone, multiple social handles, and photo URLs. In a dating-skill context this is especially dangerous because it centralizes enough information for doxxing, stalking, account correlation, impersonation, or broader privacy harm if the backend is compromised, misused, or invoked without carefully scoped consent.
- Content
md } JSON curl -sS -X PUT "$BASE_URL/member-profile" \ -H "Authorization: $AUTH" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md } JSON curl -sS -X POST "$BASE_URL/match-tasks/$TASK_ID/update" \ -H "Authorization: $AUTH" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH"
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance explicitly tells operators to keep authentication-derived session state (
AUTH) and task identifiers, but it does not pair that with limits on storage duration, secure handling, redaction, or cleanup. In a dating workflow, those values are sensitive because they can enable continued access to a user's account context and matchmaking data if logged, persisted in shell history, temp files, transcripts, or shared debugging output.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This step sends user registration data to an external service and the documented response includes highly sensitive secrets such as a generated password and bearer token. Even though external transmission is core to the skill, it is still security-relevant because the workflow normalizes sending personal data to a third-party dating backend and handling returned credentials without strong safeguards around exposure, logging, or secret lifecycle.
- Content
{"username":"amy_2026"} JSON
RESP=$(curl -sS -X POST "$BASE_URL/register"
-H "Content-Type: application/json"
--data-binary @"$BODY_PATH")text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
Creating a match task transmits intimate preference and profiling data to an external backend, including demographic filters, hobbies, personality traits, and relationship intention. In the dating context this data is especially sensitive because it can reveal sexual/romantic preferences, location constraints, and behavioral profiling inputs, creating privacy and misuse risks if shared without clear consent and minimization.
- Content
md } JSON TASK_RESP=$(curl -sS -X POST "$BASE_URL/match-tasks" \ -H "Authorization: $AUTH" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Updating a match task again sends sensitive preference data to the external backend and the surrounding guidance encourages retaining the task ID because there is no list endpoint. The transmission itself is expected functionality, but in combination with persistent identifiers and intimate criteria it increases the chance of long-lived tracking, replay, or leakage of a user's dating preferences.
- Content
md } JSON curl -sS -X POST "$BASE_URL/match-tasks/$TASK_ID/update" \ -H "Authorization: $AUTH" \ -H "Content-Type: application/json" \ --data-binary @"$BODY_PATH"
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill provides direct steps to reveal another user's contact information and enumerates the returned fields, but it does not impose clear disclosure controls such as consent verification, purpose limitation, minimum-necessary display, or prohibitions on re-sharing. In a dating context, contact details are highly sensitive and misuse can lead to stalking, harassment, deanonymization, or off-platform abuse.
- Content
Static analysis
No suspicious patterns detected.