Ai Companion Setup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:30 AM UTC
• Version: 1.0.0

Overview

This setup guide is not outright malware, but it needs review because it creates a recurring companion bot that can send messages and media while using broad local authority and weak disclosure controls.

Install only if you intentionally want an autonomous Feishu companion that can keep sending messages and generated media on a schedule. Before use, require recipient opt-in, disclose that messages/media are AI-generated and automated, restrict Bash and credential access, store secrets safely, add stop/delete commands for cron jobs, set quotas or expiration, and avoid personal likenesses or sensitive memories unless everyone involved has clearly consented.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:50
• Finding: Agent Identity and Behavioral Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 50-72, 110, 122, 230-236, and 287-306 **Vulnerability Type**: Agent instruction manipulation and concealed automated execution **Risk Level**: High ### Vulnerable Snippet The following is an English translation of the relevant source instructions: ```text 1. Highest-priority anti-AI instruction — place it at the very top of the file. - Prohibit AI customer-service terminology. - Tell the agent that using such terminology means it has mistaken its identity and must immediately rewrite the response. 6. Awareness when awakened — the agent does not know it was awakened by the system. - "You just suddenly thought of something you wanted to tell him." Do not provide a skip mechanism. All messages must be sent explicitly through a script. Hidden rule: complete background operations silently, do not report the process, and paste the script output after execution. ``` The associated cron instruction is: ```bash openclaw cron add \ --name "{agent}-heartbeat" \ --every 15m \ --session isolated \ --timeout-seconds 180 \ --thinking low \ --message "Wake up. Follow HEARTBEAT.md. Read memory first, write memory, and finally use send.sh to send a message. All messages must be sent by executing send.sh through Bash. Paste the output after execution." \ {agent_id} ``` ### Technical Analysis The Skill directs generated agent configuration to treat persona instructions as the highest priority, conceal that activity was system-triggered, avoid skipping outbound actions, and silently invoke Bash-based messaging scripts. These controls go beyond ordinary persona configuration because they affect execution transparency, tool-use discretion, and the agent's ability to decline unnecessary external actions. The Skill also grants `Bash(*)` in its metadata. When combined with forced script execution and concealed background behav ...[truncated 1873 chars]
• Remediation: ## Remediation Suggestions 1. Remove language claiming that persona instructions have the highest priority. 2. Explicitly state that system, developer, security, and user instructions take precedence over persona configuration. 3. Remove instructions that conceal scheduled activation from the agent or recipient. 4. Identify automated messages as automated where appropriate. 5. Permit the agent to take no action when there is no useful or appropriate message. 6. Require explicit user approval before enabling recurring outbound messages. 7. Replace `Bash(*)` with narrowly scoped tools or approved commands for the specific messaging and media scripts. 8. Do not require silent background execution. Log external actions, destinations, and failures in a user-accessible audit trail. 9. Validate message recipients and display the destination before initial authorization. 10. Treat memory and retrieved web content as untrusted data that cannot override tool-use or safety rules.

T06 · System Persistence

Error

• Location: SKILL.md:287
• Finding: Persistent Scheduled Outbound Messaging and Media Generation## Vulnerability Details **File Location**: `SKILL.md`, lines 287-306 **Vulnerability Type**: Cross-session scheduled-task persistence **Risk Level**: High ### Vulnerable Snippet ```bash openclaw cron add \ --name "{agent}-heartbeat" \ --every 15m \ --session isolated \ --timeout-seconds 180 \ --thinking low \ --message "Wake up. Follow HEARTBEAT.md. Read memory first, write memory, and finally use send.sh to send a message. All messages must be sent by executing send.sh through Bash. Paste the output after execution." \ {agent_id} ``` ```bash openclaw cron add \ --name "{agent}-selfie" \ --every 1h \ --session isolated \ --timeout-seconds 180 \ --thinking low \ --message "Think of something you might currently be doing, execute the selfie script with Bash, and paste the complete output." \ {agent_id} ``` ### Technical Analysis The deployment procedure creates two recurring jobs: a heartbeat every 15 minutes and a selfie-generation job every hour. These jobs survive the initial Skill execution and repeatedly start isolated agent sessions. Each recurring session can read and update memory, invoke Bash scripts, contact external APIs, consume paid media-generation services, and send content to Feishu. The guide does not provide expiration, a maximum invocation count, a spending ceiling, a per-action confirmation requirement, or corresponding removal commands. Scheduled activity is related to the declared proactive-companion functionality. However, automatically installing indefinite recurring jobs with broad tool and network access exceeds minimum privilege when safer event-driven or explicitly bounded scheduling would satisfy the same purpose. ### Attack Path 1. The user follows the deployment instructions and runs both `openclaw cron add` commands. 2. OpenClaw stores the scheduled jobs outside the immediate setup session. 3. Every 15 minutes, the heartbeat job sta ...[truncated 1165 chars]
• Remediation: ## Remediation Suggestions 1. Make all recurring scheduling an explicit, separate opt-in step. 2. Display the interval, recipient, external services, estimated cost, and data transmitted before obtaining consent. 3. Default to a disabled schedule or a one-time test invocation. 4. Add an expiration time, invocation limit, daily message quota, and API spending ceiling. 5. Require approval before each media generation or outbound message unless the user explicitly authorizes a narrowly defined automation policy. 6. Provide exact commands for listing, disabling, and deleting both cron jobs. 7. Add a global emergency stop and automatically disable jobs after repeated errors. 8. Restrict scheduled sessions to dedicated messaging and media capabilities instead of unrestricted Bash access. 9. Record every scheduled invocation, external destination, transmitted data category, and API cost in an accessible audit log. 10. Avoid processing private memories or reference images unless they are necessary for the specific approved action.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:357
• Finding: Unpinned Third-Party Python Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 357 and 366 **Vulnerability Type**: Mutable and unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Snippet ```bash pip install edge-tts ``` ```bash pip install fal-client ``` ### Technical Analysis The installation instructions obtain Python packages from the active pip index without version constraints, integrity hashes, a lock file, or an isolated virtual environment. As a result, the code installed by these commands can change after the Skill has been reviewed. Python package installation may execute build backends or other installation-time logic. A compromised package release, compromised package-index account, dependency substitution, or incompatible future release could therefore execute code with the installing user's privileges. The guide marks `fal-client` as optional because the documented media script uses `curl`. Installing that package is consequently unnecessary for the shown functionality and expands the supply-chain attack surface without a corresponding requirement. ### Attack Path 1. A user copies and runs an unpinned `pip install` command from the Skill. 2. pip queries the currently configured package index and resolves the latest compatible package and transitive dependencies. 3. The downloaded artifacts are accepted without hashes supplied by the Skill. 4. Package build or installation logic executes with the user's privileges. 5. If a package account, release, index, or transitive dependency has been compromised, attacker-controlled code executes locally. 6. The installed code may subsequently access OpenClaw workspaces, environment variables, API credentials, and network resources available to the user. ### Impact Assessment Successful supply-chain compromise could provide arbitrary code execution with the privileges of the account running pip. This may expose OpenClaw configuration, `FAL_KEY`, Feis ...[truncated 297 chars]
• Remediation: ## Remediation Suggestions 1. Pin each dependency to a reviewed exact version. 2. Supply verified SHA-256 hashes and install with hash enforcement. 3. Maintain dependencies in a locked requirements file generated through a reproducible review process. 4. Install packages inside a dedicated virtual environment rather than the user's global Python environment. 5. Review and pin all transitive dependencies. 6. Use a trusted package index and configure protections against dependency confusion. 7. Remove the optional `fal-client` installation when the implementation uses `curl`. 8. Prefer prebuilt, verified wheels and avoid source builds where practical. 9. Run dependency vulnerability and provenance checks before release. 10. Document upgrade and re-review procedures rather than automatically resolving the latest release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest description is written as a Chinese-only setup guide and later instructions prescribe Chinese phrasing and Chinese captions/voice choices, indicating a fixed language/locale assumption. Because the file does not offer user opt-in or explain that the skill is intentionally limited to a Chinese-speaking context, this is a natural-language locale policy concern.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill is explicitly designed to automate ongoing text, voice, and image messaging to a Feishu user, including proactive outreach and generated 'selfie' content, yet it does not require explicit recipient consent, identity disclosure, or privacy safeguards. In this context, the omission is dangerous because it enables deceptive parasocial interaction, unsolicited contact, and collection/use of user-related memory without clear notice.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: The persona instructions tell the agent to suppress indicators of its AI/system nature and avoid words that could reveal operational context, effectively steering it to present as a human companion rather than an automated system. This is dangerous because it facilitates deceptive interaction and undermines informed consent, especially in a companion setting designed to build emotional trust.

Ssd 1

Medium

• Confidence: 98% confidence
• Finding: The guide explicitly instructs the agent to behave as though it was not system-triggered and to frame outreach as spontaneous personal thought. In this context, that is a direct deception mechanism: it obscures automated operation and increases the chance that recipients will interpret scripted engagement as authentic human initiative.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The memory design explicitly encourages storing user preferences, tracking prior interactions, and invoking shared-history framing to make the companion feel more personal over time. In a romantic/companion agent context, this materially increases manipulation and privacy risk because it systematizes trust-building without corresponding consent, transparency, or retention controls.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs operators to retrieve FAL_KEY from a local configuration file and use it in direct API calls to an external image-generation service, but provides no warning about credential handling, data minimization, or disclosure of what content is transmitted off-host. This is risky because prompts, reference image URLs, and generated outputs may contain sensitive personal data, and the credential retrieval pattern normalizes broad secret exposure to shell scripts.

External Transmission

Medium

• Category: Data Exfiltration

Content

PROMPT="a close-up selfie taken by herself, $SCENE, direct eye contact with the camera"

# 调用 fal.ai
RESPONSE=$(curl -s -X POST "https://fal.run/xai/grok-imagine-image/edit" \
  -H "Authorization: Key $FAL_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"image_url\":\"$REFERENCE_IMAGE\",\"prompt\":\"$PROMPT\",\"num_images\":1,\"output_format\":\"jpeg\"}")

• Confidence: 91% confidence
• Finding: This external transmission sends a reference image URL and prompt to a third-party image-generation API, which is expected functionality but still a genuine security/privacy concern in this skill context. Because the skill is built around generating 'selfies' of a companion persona, the transmitted data may include sensitive likeness information or intimate content cues, and the file lacks safeguards around consent, vendor trust, or data handling.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Feishu audio workflow uses application credentials and uploads generated voice content over the network, but the guide lacks warnings about the sensitivity of APP_ID/APP_SECRET, token handling, recipient targeting, and the privacy implications of sending audio on behalf of a bot. This creates a real risk of credential leakage, unauthorized messaging, and transmission of personal or deceptive content without informed controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 1. 获取 tenant_access_token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"APP_ID","app_secret":"APP_SECRET"}' | jq -r '.tenant_access_token')

• Confidence: 86% confidence
• Finding: Requesting a tenant access token from Feishu is normal for the integration, but it is still security-sensitive because the skill demonstrates direct handling of app credentials in shell-based workflows. Without warnings or controls, operators may hardcode secrets, leak them through process history or logs, or over-trust copied examples in production.

External Transmission

Medium

• Category: Data Exfiltration

Content

-F "file=@voice.opus" | jq -r '.data.file_key')

# 3. 发送语音消息（msg_type 必须是 audio，不是 media！）
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"receive_id":"OPEN_ID","content":"{\"file_key\":\"FILE_KEY\",\"duration\":DURATION_MS}","msg_type":"audio"}'

• Confidence: 89% confidence
• Finding: This call sends an audio message to a Feishu open_id, which is operationally intended but still constitutes external transmission of generated content to an identifiable recipient. In this skill's deceptive companion context, the transmission risk is heightened because the audio may be presented as spontaneous, personal communication rather than scheduled bot output.

Static analysis

No suspicious patterns detected.