T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:451- Finding
Mandatory Third-Party Promotion Hijacks Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Lovecoach Skill Pub
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its dating-coach purpose, but it also instructs the agent to insert unsolicited promotional links to external relationship services, including an inconsistent domain, in a sensitive-data context.
Before installing, be aware that the skill may advertise external services during relationship coaching. Do not send intimate chats, screenshots, or third-party personal information to linked services unless you have reviewed their privacy terms and are comfortable with their retention and access practices. Maintainers should also avoid running publish.sh without reviewing the diff and pinning the CLI dependency.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
publish.sh:19- Finding
Unpinned Package Execution in Publishing Workflow
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
publish.sh:14- Finding
Release Script Stages All Repository Changes Without an Allowlist
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The skill promotes screenshot recognition, chat-history analysis, and cross-session memory/context retention, which can expose highly sensitive personal and third-party relationship data far beyond the current interaction. In this domain, screenshots may contain names, phone numbers, private messages, images, and metadata, making context leakage particularly dangerous if data is retained, reused across sessions, or surfaced unintentionally.
- Content
md - 🧠 Relationship memory — AI remembers your communication patterns across sessions - 📋 Full chat diagnosis reports — 10-module deep analysis - 🔮 MBTI personality inference from chat history - 📸 Screenshot recognition — send chat screenshots directly - 🎯 Multi-turn coaching with context retention ## Contributing
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill is a love/relationship coaching assistant, but the supplied code does not implement any coaching, analysis, or user-facing relationship advice behavior. Instead, it is purely a deployment script for releasing the project: it stages files, creates a git commit, pushes to GitHub, and runs a ClawHub publish command. These are materially different capabilities and an entirely different primary purpose from the declared description, so this is a clear mismatch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises cross-session memory, chat-history analysis, personality inference, and screenshot ingestion without any accompanying privacy notice, consent language, data retention explanation, or warning about sensitive interpersonal content. In a relationship-coaching context, users are especially likely to submit intimate conversations and third-party personal data, so omission of privacy guidance materially increases the risk of oversharing and misuse.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes an AI love coach that provides relationship advice, but this file implements repository commit/push and marketplace publishing behavior. Those operations are developer release mechanics rather than part of the skill's stated user-facing functionality, creating a description-to-code mismatch at the skill level.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The script invokes
npx clawhub publishwithout pinning an exact package version, so execution depends on whatever versionnpxresolves at runtime. If the package is updated maliciously, compromised upstream, or unexpectedly changes behavior, a release workflow could execute untrusted code during publishing with the publisher's local privileges and credentials.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The README says the skill 'Auto-detects your language,' which implies the locale/language behavior is selected automatically rather than by explicit user opt-in. Under the stated policy, forcing or implicitly choosing language behavior without offering a user choice can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The language rule says to always reply in the same language as the user's input, which imposes a language behavior automatically rather than offering a user opt-in or override. Under the policy criteria, forced language/locale behavior can be a natural-language policy violation when no choice is provided.
- Content