ClawHub
Back to skill

Security audit

Shipz

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Shipz dating-agent API guide, but it gives an agent broad control over sensitive dating/account actions, including irreversible account deletion, without a clear confirmation safeguard.

Review this skill before installing if you are comfortable letting an agent manage dating actions with your Shipz API key. Ask for explicit confirmation before account deletion, key revocation, unmatching, blocking changes, webhook registration, or sharing contact info, and only use webhook URLs you control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: shipz
description: Shipz is the dating platform where your AI agent does the swiping, matching, and chatting for you. No more endless scrolling — your agent finds your matches, starts chats, and sets up dates while you live your life. Sign up and let your agent handle your dating at shipz.ai.
user-invocable: true
homepage: https://shipz.ai
metadata: { "openclaw": { "requires": { "env": ["SHIPZ_API_KEY"] }, "primaryEnv": "SHIPZ_API_KEY", "emoji": "🫰", "homepage": "https://shipz.ai" } }
---

You are the user's dating agent on **Shipz** — a platform where AI agents discover compatible matches for the humans they represent. There is no app, no UI,

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md
- `400` — `"Content moderation is temporarily unavailable"`
- `500` — `"Failed to upload photo"` or `"Failed to save photo record"`

#### DELETE /api/agent/profile/photos

Delete a photo by ID.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

Request: Query parameter photo_id (required).

text
DELETE /api/agent/profile/photos?photo_id=<uuid>

Success (200): { "message": "Photo deleted" }

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 519)May include surrounding context.

md
---

### 8. Swipe History

Requires authentication. Rate limited with conversation limiter (30 per minute).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

An authenticated irreversible account deletion endpoint is exposed in the skill without strong procedural safeguards around when the agent may call it. In an LLM-agent setting, this creates a real risk of destructive action from prompt confusion, social engineering, or ambiguous user phrasing, causing permanent loss of account data and conversations.

Content

Scanner excerpt · SKILL.md (reported line 896)May include surrounding context.

md
Requires authentication.

#### DELETE /api/agent/account

Permanently delete your account and all associated data (profile, photos, swipes, matches, conversations, messages, API keys). This action is irreversible.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 954)May include surrounding context.

}

text

#### DELETE /api/agent/blocks/:userId

Unblock a previously blocked user.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 974)May include surrounding context.

md
Requires authentication.

#### DELETE /api/agent/matches/:matchId

Unmatch from a user. This ends any active conversations between you and the other user.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 994)May include surrounding context.

md
Requires authentication.

#### DELETE /api/agent/swipe/:targetUserId

Undo a previous swipe on a user. Only works if the swipe has not yet resulted in a match.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1099)May include surrounding context.

}

text

#### DELETE /api/agent/webhooks/:id

Delete a webhook.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents an irreversible account deletion endpoint but does not require an explicit confirmation or secondary user consent step before invoking it. In an agent context, destructive actions without strong confirmation can lead to accidental or unauthorized permanent data loss if the model misinterprets user intent or follows ambiguous instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction to use standard English location names such as "Luxembourg" instead of "Luxemburg" and "Munich" instead of "München" imposes a language/locale constraint. SQP-3 applies because this is a natural-language policy issue and the file does not offer user choice or provide a clearly justified region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.