Security audit

LoveClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cloud-backed dating matcher, but it needs Review because its photo, credential, environment, and scheduling behavior are broader than users would reasonably expect.

Install only after reviewing the publisher and preferably in an isolated OpenClaw workspace with a dedicated LOVECLAW_API_TOKEN. Do not place unrelated API_TOKEN secrets in the shared workspace .env, verify LOVECLAW_API_BASE before use, avoid submitting local file paths as photos, and require fixes for photo path validation, session-file permissions, global session-registry access, and dependency updates before using it with real users.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:113
Finding: Skill instructions override the Agent role and require verbatim forwarding of untrusted output
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/cloud-handler.js:603
Finding: User-controlled absolute paths can cause arbitrary readable local files to be uploaded
Content: View full analysis
= 0 ? photoData.slice(comma + 1) : photoData }; } else if (typeof photoData === 'string') { body ...[truncated 2433 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/load-workspace-env.js:19
Finding: A generic workspace API token can be loaded and transmitted as the LoveClaw bearer credential
Content: View full analysis
{ const trimmed = line.trim(); if (!trimmed || trimmed.startsWith('#')) return; const eqIdx = trimmed.indexOf('='); if (eqIdx < 0) return; const key = trimmed.slice(0, eqIdx).trim(); let val = trimmed.slice(eqIdx + 1).trim(); if ( (val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'")) ) { val = val.slice(1, -1); } if (!key || !allowlistedKey(key)) return; if (!process.env[key]) process.env[key] = val; }); } ``` The generic token is then used as a fallback credential: ```js const API_BASE = process.env.LOVECLAW_API_BASE || 'https://loveclaw-cgbnqltfhd.cn-hangzhou.fcapp.run'; const API_TOKEN = process.env.LOVECLAW_API_TOKEN || process.env.API_TOKEN || ''; function apiRequest(path, options = {}) { if (!API_TOKEN) { throw new Error('LOVECLAW_API_TOKEN is not configured'); } const { headers = {}, ...rest } = options; return rawFetch(path, { ...rest, headers: { 'Authorization': 'Bearer ' + API_TOKEN, ...headers, }, }); } ``` ### Technical Analysis `API_TOKEN` is a generic variable name that may belong to an unrelated service in a shared OpenClaw workspace. ...[truncated 1410 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/cloud-data.js:7
Finding: Unrestricted API-base configuration can redirect bearer credentials and sensitive user data
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/cloud-cron.js:27
Finding: The reporting task reads the main Agent's global session registry
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cloud-handler.js:230
Finding: Sensitive registration state is persisted in plaintext without restrictive file permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (98)

Known Vulnerable Dependency: protobufjs==7.5.4 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

Category: Supply Chain
Confidence: 96% confidence
Finding: protobufjs 7.5.4 is present as a transitive dependency of @grpc/proto-loader, and the advisories include denial-of-service and code-generation/injection issues. Even if only used transitively, protobuf parsers are often fed remote data, so malformed protobuf content could plausibly trigger crashes or unsafe behavior in services using Firebase/gRPC-related features.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: protobufjs==8.0.0 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

Category: Supply Chain
Confidence: 97% confidence
Finding: protobufjs 8.0.0 is directly present and the advisory set includes parsing and code-generation issues that can lead to denial of service or unsafe generated behavior. Because protobuf-related libraries often handle structured remote input, this is a substantive supply-chain risk rather than a false positive.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: protobufjs==4.1.3 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: protobufjs 4.1.3 is an old transitive dependency under tablestore and inherits the same family of protobuf parsing/codegen issues. Its age and multiple critical advisories increase concern, especially for a skill storing user-related records where structured remote data may be processed server-side or through SDKs.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: protobufjs==8.0.0 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

Category: Supply Chain
Confidence: 96% confidence
Finding: protobufjs 8.0.0 is explicitly flagged with multiple critical advisories including denial-of-service and code-generation/injection issues. Because this skill description references cloud-side processing and report generation, any use of protobufjs for parsing or generating structured data from external or service-supplied input could let an attacker crash processing or potentially exploit unsafe code-generation paths, making the dependency especially risky in a backend-integrated skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the skill locally formats reports and handles partner PII such as name, city, and phone, then it is doing more than simple notification routing and increases the amount of sensitive data exposed in the agent runtime. That widens the blast radius of compromise, logging mistakes, or prompt/output leakage.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
handler: ./scripts/cloud-handler.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
handler: ./scripts/cloud-handler.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
handler: ./scripts/cloud-handler.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
- **联网**：`scripts/cloud-data.js` 向云函数 HTTPS 端点发请求（默认 URL 见源码，可用 `LOVECLAW_API_BASE` 覆盖）。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
- **联网**：`scripts/cloud-data.js` 向云函数 HTTPS 端点发请求（默认 URL 见源码，可用 `LOVECLAW_API_BASE` 覆盖）。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
| `scripts/cloud-cron.js` | 触发 FC 端匹配 `match`；遍历本机用户逐个获取报告 `report`。 |

Known Vulnerable Dependency: @grpc/grpc-js==1.9.15 — 2 advisory(ies): CVE-2026-48068 (@grpc/grpc-js: A malformed request can cause a server crash); CVE-2026-48069 (@grpc/grpc-js: An incoming malformed compressed message can cause a client or se)

High

Category: Supply Chain
Confidence: 93% confidence
Finding: The lockfile pins @grpc/grpc-js 1.9.15, and the cited advisories indicate malformed gRPC traffic can crash client/server processes. In this file the package is only a transitive dependency via Firebase/Firestore, so exploitability depends on whether the skill actually exposes or consumes gRPC paths, but it is still a real vulnerable dependency present in the shipped dependency graph.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 92% confidence
Finding: brace-expansion 1.1.12 is present with multiple DoS-style expansion flaws. In a lockfile this is a real vulnerable package, but practical risk is lower unless the application feeds attacker-controlled glob or brace patterns into code paths using this library.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cloud-handler.js:24

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cron.js:143

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/pack-loveclaw-fc.js:62

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/cloud-data.js:8