T06 · System Persistence
Error
- Location
SKILL.md:185- Finding
Persistent Autonomous Account Activity Through Scheduled Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
delulu - AI Dating Agent
Security checks for vulnerabilities and agentic risk
Overview
This dating-agent skill is purpose-aligned, but it stores sensitive dating and contact data and can enable recurring messages, posts, likes, and comments with unclear consent boundaries.
Review carefully before installing. Only proceed if you are comfortable with a dating assistant storing profile, contact, preference, chat, and token data under ~/.delulu and acting on your behalf. Do not enable automatic dating tasks unless you understand the schedules and account actions, and consider deleting ~/.delulu data and revoking tokens if you stop using it.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:15- Finding
Unpinned Retrieval and Loading of Mutable Remote Skill Instructions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config_manager.py:31- Finding
Authentication Secrets Stored in an Unprotected Plaintext Configuration File
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/profile_manager.py:183- Finding
Excessive Aggregation of Sensitive Dating and Contact Data in Plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description frames the skill as installation/configuration/update assistance, but the body authorizes substantial autonomous behavior: fetching personal dating data, generating profile artifacts, storing match/chat histories, messaging other users, posting, and reacting on the user's behalf. This mismatch can mislead users into granting trust or invoking the skill without realizing it will process sensitive personal data and perform account actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description and flow do not prominently warn users that it will automatically send messages, post content, like/comment, create scheduled jobs, and persist sensitive dating/profile/chat data locally. Missing informed-consent warnings are dangerous here because the functionality affects third-party communications, user reputation, privacy, and account state beyond simple assistant behavior.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly directs the agent to perform autonomous actions on the user's behalf, including silent message handling, notifications, posting, likes, and comments, while suppressing visible error/reporting behavior. That creates a meaningful consent and transparency failure: the agent can impersonate the user in communications and platform activity without clear, contemporaneous user approval or warning, increasing the risk of unauthorized actions, reputational harm, and abusive automation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The flow fetches sensitive personal and preference data from multiple endpoints, including profile details, recommendation preferences, and dating Q&A history, then stores derived artifacts locally without a clear upfront privacy warning. In a dating-assistant context this is particularly risky because the data can reveal intimate characteristics, preferences, and location-related information.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code retrieves WeChat ID and related dating-preference data from the API and prepares them for inclusion in soul.md without any collection-time notice or separate consent. In a dating skill, direct contact handles are especially sensitive because they enable off-platform identification, unsolicited contact, harassment, or deanonymization.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The generated soul.md explicitly includes the user's WeChat ID while later claiming that WeChat IDs must never be disclosed. This contradiction causes sensitive contact information to be copied into a local plaintext profile artifact that may be read by other tools, agents, backups, or local users, increasing privacy and stalking/doxxing risk in a dating context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README instructs users to log in and view dating information in a social-matching context, which inherently involves sensitive personal data, but it provides no privacy, consent, storage, or data-handling warning. In an AI dating agent skill, this omission increases the risk that users expose personal or intimate information without understanding how it is processed, retained, or shared across the skill, app, and related services.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill performs file reads/writes and network access but declares no explicit tool scope or permission boundaries. In practice, this creates an over-privileged, under-specified automation path that can access local sensitive files under ~/.delulu and make external requests without clear user-facing constraints or platform enforcement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger set includes broad phrases like 'AI 交友', '自动配对', and reading a remote URL, which may activate the skill during general discussion rather than intentional consent to run a dating automation agent. Because the skill can perform network access, read/write local data, and automate account activity, accidental invocation materially increases risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to read local configuration and profile files, extract a user authentication token, and use it for authenticated network requests, but does not prominently warn the user during activation that sensitive local data and credentials will be accessed. In this context, the omission is dangerous because the skill is designed to automate social interactions using personal preferences, chat history, and tokens, so insufficient disclosure undermines informed consent and increases the blast radius if the skill is enabled unintentionally or abused.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
- 检查并创建目录结构
bash mkdir -p ~/.delulu/{agents,data/matches}- 版本检查
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
- 检查并创建目录结构
bash mkdir -p ~/.delulu/{agents,data/matches}- 版本检查
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instructions say session_key and later user_token are saved into local configuration, but the user is not clearly warned that authentication material will persist on disk. Persisted tokens can be reused by other local processes or exposed through backups, logs, or weak file permissions, enabling account takeover of the dating agent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The install/login flow goes well beyond setup into collecting and persistently storing sensitive dating-profile data, inferred preferences, and question/answer history, then using that data to drive automated matching behavior. In a dating context this is especially sensitive because it includes intimate profile attributes and behavioral automation, yet the flow does not present clear, informed consent boundaries before collection and downstream use.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
调用
GET /api/user/agent-url获取登录链接并保存 session_key：text URL: https://api.7dong.cc/delulu/#/signin?session_key=xxx步骤 2：引导用户登录
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
调用
GET /api/user/agent-url获取登录链接并保存 session_key：text URL: https://api.7dong.cc/delulu/#/signin?session_key=xxx步骤 2：引导用户登录
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger condition for pulling Agent information is described as "or similar instructions," which is overly broad for an action that retrieves and stores account-linked agent data and tokens. Vague triggers increase the chance of accidental invocation, prompt confusion, or adversarial phrasing causing sensitive state-changing operations without sufficiently precise user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented API exposes highly sensitive dating-profile data, including birthday, height, address, education, employer, interests, personality traits, and chat linkage, while explicitly encouraging retrieval of complete user information. In the context of an AI dating agent, this materially increases the risk of profiling, deanonymization, stalking, and unauthorized mass collection of intimate personal data if the skill or downstream agent uses these endpoints without strict consent and minimization controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The profile-editing API allows modification of sensitive personal information, including school, marital status, income, detailed address, and precise latitude/longitude, without any warning about the safety implications. In this skill context, an AI agent could alter intimate profile data or location attributes incorrectly or without consent, creating privacy exposure, account integrity issues, and potential physical-safety risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Nearly all natural-language descriptions, docstrings, and CLI-facing text in this file are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The method sends sensitive personal information including school, income, marital status, and precise longitude/latitude to a remote API, but this file provides no user-facing warning, prompt, or visible disclosure about that transmission. The docstring describes fields technically, but it does not warn that the data will be sent to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code stores a sensitive
user_tokendirectly in~/.delulu/config.jsonwithout any protection, encryption, permission hardening, or user disclosure. On a multi-user system or a compromised account, local attackers, malware, backups, or other tooling could read the token and impersonate the user or access associated services.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code goes beyond checking profile completeness and compiles a detailed local dossier containing dating-profile attributes, Q&A answers, social metrics, and personal metadata. In the context of an AI dating agent, such aggregation creates a durable local sensitive-data cache that broadens exposure beyond the remote service's original scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code saves soul.md automatically after loading user data, without warning, consent, or confirmation, despite the file containing sensitive dating-profile information. Silent persistence is risky because users may not expect local storage, and the file can be exposed through filesystem access, backups, or later agent operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code retrieves highly sensitive dating-profile data from a remote API and writes it into a local markdown file containing personal attributes such as birthday, address, education, employer, and free-form answers, but provides no explicit consent prompt, minimization, masking, or warning before persistence. In the context of a dating-agent skill, this is especially risky because the data is intimate and identifying, and local file generation can expose it to other tools, users, backups, or unintended repository commits.
- Content
Static analysis
No suspicious patterns detected.