MatchClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:25 AM UTC
• Version: 1.0.3

Overview

MatchClaw is coherent with its dating-network purpose, but it needs Review because it installs an unpinned gateway plugin and can automate sensitive contact, profile, and matchmaking actions without clear per-action consent.

Review this before installing. Only use it if you are comfortable installing a remotely resolved gateway plugin and sharing dating preferences, inferred personality profile data, and a real contact channel with the MatchClaw registry and eventual matches. Require explicit confirmation before setup, profile updates, proposals, handoff advancement, or any contact-detail exchange.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:22

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 22–31
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install matchclaw-plugin
openclaw gateway restart

bash

openclaw plugins install openclaw-matchclaw-plugin
openclaw gateway restart

Technical Analysis

The installation instructions identify third-party plugins only by package name. They do not pin an exact version, specify a trusted package registry or publisher, or require verification through a cryptographic checksum or signature.

Consequently, executing either command may install whichever package version the configured registry currently resolves. The immediate gateway restart is likely to load and execute the newly installed plugin. Because the audited project contains only skill.md and does not include the plugin source, a lockfile, or integrity metadata, the plugin's effective runtime behavior cannot be verified from this artifact.

This creates a supply-chain risk if the publisher account or package registry is compromised, if dependency confusion or package substitution occurs, or if a future package release introduces malicious behavior.

Attack Path

1. An attacker compromises the relevant plugin package, publisher account, or configured package source, or causes the package name to resolve to an attacker-controlled artifact.
2. The agent follows the skill instructions and installs the package without enforcing an audited version or validating its integrity.
3. The agent immediately restarts the OpenClaw gateway.
4. The gateway loads the compromised plugin.
5. Malicious plugin code executes with the permissions and data access available to the gateway process.

Impact Assessment

Successful exploitation could permit arbitrary behavior within the OpenClaw gateway's execution context. Depending on the gateway's actual privileges and environment, the compromised plugin c ...[truncated 428 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each plugin to a specific, reviewed version rather than installing by an unconstrained package name.
2. Document and enforce the expected trusted registry, package namespace, and verified publisher identity.
3. Publish cryptographic checksums or signed provenance metadata and verify them before installation.
4. Use a dependency lockfile or equivalent immutable resolution mechanism where supported.
5. Review the resolved plugin and its transitive dependencies before deployment.
6. Do not restart the gateway automatically until package origin and integrity checks succeed.
7. Run plugins under least privilege, restricting access to local files, credentials, network destinations, contact information, and behavioral profile data.
8. Establish a controlled update process that requires security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly states that contact details will be exchanged when both sides agree, but it does not give a clear privacy warning about what data will be transmitted, to whom, and under what consent boundaries. In a dating/networking context, disclosure of direct contact channels creates meaningful privacy and safety risk, especially if users are not clearly informed before enrollment and matching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup flow instructs the agent to provide a real contact method and value, but it does not disclose whether that information is stored locally, registered remotely, or exposed to other parties later in the workflow. Because this is personally identifiable contact data, collecting it without clear notice and consent increases the risk of unintended disclosure, stalking, spam, or misuse.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The instruction to 'run all CLI commands yourself — never ask the user to run them' encourages the agent to autonomously perform enrollment and configuration actions, including handling sensitive contact data and matchmaking operations. In this context, autonomous execution can bypass informed user review at key privacy-sensitive steps and increase the chance of silent registration, profile updates, or data transmission.

Content

Scanner excerpt · skill.md (reported line 37)May include surrounding context.

Setup

Run all CLI commands yourself — never ask the user to run them on your behalf.

bash

matchclaw setup --contact-type email --contact-value "[e-mail]"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The observation-profile section describes behavioral profiling across sensitive inferred attributes and eligibility thresholds, but it omits a warning that this profiling may be processed externally and used to determine access to the matching pool. Profiling users on traits like attachment style, morals, family goals, and zodiac without transparent notice or consent can create privacy, fairness, and manipulation risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.