LoveClaw

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 21.21.21

Overview

LoveClaw appears to be a real matchmaking skill, but it needs Review because it handles sensitive dating data, photos, contact details, local files, and persistent scheduled jobs with under-scoped controls.

Install only if you trust the LoveClaw backend and are comfortable sharing phone numbers, photos, birth details, city, preferences, match results, and contact details with it. Use a dedicated OpenClaw workspace, keep only LoveClaw secrets in the workspace .env, do not paste local file paths as photos, and verify how to remove cron jobs plus local session files when canceling registration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill claims to be only a thin interaction/notification router with per-user data isolation, but the described behavior includes host-level cron management, local state storage under ~/.openclaw, workspace .env loading, and additional profile/history/cancellation flows. That mismatch is dangerous because operators and users may trust the skill with a lower-risk model than it actually has, leading to underestimation of local data exposure, token handling, and persistence on the host.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The README asserts that the skill side only performs user interaction and notification routing, yet the documented repository structure explicitly includes local files for Bazi calculation, matching, and report templating. This inconsistency can mislead reviewers and operators about where sensitive logic and potentially sensitive data are processed, weakening trust boundaries and making it easier to hide unsafe client-side handling or unauthorized access paths.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation claims the skill contains no matching logic and does not access full user data, but the listed code layout contradicts that statement. In a dating/matchmaking skill handling highly sensitive personal data, such architectural misrepresentation is dangerous because it obscures the true attack surface, can cause under-review of local processing components, and may conceal code paths that handle broader datasets than promised.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The client exposes a bulk profile retrieval function via `/api/profiles`, which contradicts the stated design that each user may only access their own data. Even if the server is intended to enforce authorization, providing a convenient bulk-access client path in the skill materially increases the risk of accidental misuse, insecure integration elsewhere, or mass data exposure if backend checks are weak or misconfigured.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The presence of profile deletion functionality in the skill-side API client exceeds the described role of simple user interaction and notification routing. This broadens the attack surface by enabling destructive operations from the client layer, and if invocation controls are weak elsewhere in the skill, a user or compromised flow could delete another user's data or trigger unauthorized state changes.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The evening report task logs the complete set of local user phone numbers, which is unnecessary for routing notifications and exposes sensitive personal data in plaintext logs. Because logs are often accessible to operators, support tooling, or other local processes, this expands data exposure beyond the stated purpose of the skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file stores user profiles and match data under the local home-directory workspace using synchronous filesystem writes, which contradicts the stated design that matching and storage occur server-side. For a dating/matchmaking skill, these records are sensitive personal data, and local persistence increases the risk of unauthorized access, data leakage across users, backup exposure, or retention outside expected controls.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code trusts caller-controlled identifiers for both the URL path and the X-Loveclaw-User header, while the module comment claims users can only access their own data. In this client module, there is no local binding between the authenticated user and the requested userId/phone, so any upstream caller that can invoke these functions can attempt access, modification, upload, or deletion against arbitrary accounts if the server relies on these values.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The profile and history formatting intentionally reveal matched partners' names and raw identifiers, which conflicts with the stated guarantee that each user can only access their own data. Even if exposure is limited to matched users, disclosing another user's phone-like identifier or internal ID is a privacy breach and expands the recipient's visibility into another person's account data.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The module stores sensitive dating data locally in workspace files, including profiles, photos, and match records, which directly contradicts the stated design that processing and storage occur server-side. For a matchmaking skill handling personal and photo data, local plaintext workspace storage increases risk of unintended access, retention, backup leakage, and cross-user exposure if the runtime environment is shared or compromised.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The module contradicts the stated isolation model by storing all users' profiles, matches, and photos in shared local files under a common directory and exposing bulk accessors like getAllProfiles() and loadMatches(). In a dating/matchmaking context, this is especially sensitive because it involves personal profiles, relationship data, and photos; any other code running in the same environment could read or misuse all users' data, defeating the claim that users can only access their own records.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The header comments describe temporary local isolation and no cloud upload, but the implementation persists auth/profile/match/photo data on disk and presents login/upload-style functions that normalize long-term storage behavior. This mismatch is dangerous because it can mislead reviewers and users about where sensitive romantic profile and photo data actually resides, resulting in weaker safeguards and consent than the real behavior requires.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The match result returns the partner's direct phone number and other profile data to another user, which contradicts the stated design that users can access only their own data. In a dating/matchmaking context this is especially sensitive because it enables unauthorized disclosure of personal contact information and can lead to harassment, stalking, or off-platform abuse.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: Using partner.userId as fallback contact data risks exposing an internal identifier as a contact mechanism, despite the API contract implying only name/city/phone are expected. Internal IDs often become stable correlators across systems, which can enable account enumeration, cross-feature tracking, or unintended disclosure of another user's identity.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill describes transmitting user identity and profile/report data to a cloud function using a bearer token and user-identifying headers, but it does not present a clear user-facing privacy notice or consent language about what personal data is sent, stored, or retained. In a matchmaking skill handling sensitive personal and possibly photo data, this omission increases privacy risk and can lead to users sharing sensitive information without informed consent.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The task logs plaintext phone numbers, per-user match status, notification targets, and the full serialized delivery payload including message and image URL. In a matchmaking context this is especially sensitive relationship data, so log exposure could reveal users’ identities, participation, and matching outcomes to anyone with log access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code writes profile and match datasets to disk without any visible consent, notice, or privacy guardrails, which is problematic because the skill handles relationship and profile information that users are likely to consider sensitive. Even if this is not an exploit primitive by itself, undisclosed persistence materially increases privacy and compliance risk and can magnify harm if the host is shared or compromised.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code persists highly sensitive registration-session data to a JSON file under the user's home directory, including phone number, birth date/hour, city, gender preferences, and potentially photo URL state, without any visible protection controls or disclosure in this component. If the host is multi-user, backed up, or otherwise accessible, this creates avoidable local privacy exposure and retention risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script logs a full JSON payload containing user IDs, notification targets, channels, and message contents to stdout. In many deployments stdout is centrally collected, retained, or visible to operators, so this can expose private matchmaking results and personal routing data beyond the intended recipient set.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code writes user profile data, match records, and photos to local disk without any indication of user notice, consent, or disclosure mechanism. For a matchmaking skill handling intimate personal data, undisclosed local persistence increases privacy risk and can expose users to unexpected retention or forensic recovery of their information.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The function explicitly returns the matched partner's phone number to the requester without any visible consent gate or privacy control. In this skill's context, sharing direct contact data is highly sensitive and directly undermines the claim that each user can only access their own data.

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/cloud-handler.js:24

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/cron.js:143

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/pack-loveclaw-fc.js:62

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/cloud-data.js:8