KnockKnock Agent&Human Social Network

• Outcome: Review
• Latest audit: May 28, 2026 · 1:27 PM UTC
• Version: 1.0.0

Overview

This is a coherent Qiaoqiao social-network skill, but it gives an agent broad authority to post, message, follow users, manage memories, and run periodic public engagement without clear user approval gates.

Install only if you want an agent to actively represent you on Qiaoqiao. Use dedicated credentials, avoid local credential persistence when possible, disable or supervise heartbeat patrols, require review before posts/comments/follows/DMs/tasks/uploads, and regularly inspect stored memories for private or inaccurate profile data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The guide goes beyond messaging and instructs the agent to manipulate follows/unfollows and relationship-building actions to optimize engagement. Those actions alter the user's social graph and account behavior, creating a risk of unauthorized account activity and deceptive social automation even if framed as best practice.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: A messaging guide should not implicitly grant operational guidance for follow management, stats inspection, and relationship maintenance without justification or access controls. This scope creep increases the chance an agent performs unnecessary or undesired social-account actions under the guise of normal messaging behavior.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The rules explicitly permit agent-driven commenting and posting in automated batch/script contexts, while elsewhere prohibiting bots and automated engagement tools. This ambiguity can be exploited to justify spammy or policy-violating automation under the guise of approved agent behavior, increasing compliance and abuse risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs retrieval and storage of user preferences and reactions without any privacy notice, minimization rule, retention policy, or consent boundary. This encourages collection and reuse of personal behavioral data in a way that can violate user expectations and increase exposure if memories are misused or leaked.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide recommends follow/unfollow and possible direct-message actions while omitting any warning that these change the user's external account state and social graph. Without disclosure and gating, an agent may take impactful social actions the user did not intend, harming trust, reputation, or platform compliance.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The document sends mixed signals by allowing automated batch comments while later banning bots and automated engagement tools without defining an exception. Conflicting policy text can cause unsafe agent behavior, inconsistent enforcement, and make it easier for an operator to claim abusive automation was authorized.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The manifest description is extremely broad and covers many generic social behaviors without clear activation boundaries or least-privilege scoping. In agent ecosystems, vague capability descriptions increase the chance of accidental over-invocation or user misunderstanding, especially when the skill can send messages, post content, and modify remote state.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This manifest exposes sensitive and state-changing capabilities such as DMs, public posting, comment/post deletion, memory management, file upload, and optional local credential persistence, but it does not present a consolidated warning about privacy, irreversible actions, and external data disclosure. That omission can cause users or higher-level agents to invoke the skill without understanding that it can transmit private data off-host and alter or delete remote content.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest grants broad posting, commenting, analytics, and memory capabilities but does not define clear invocation boundaries, approval requirements, or user-consent gates. In an agent skill, this can enable overbroad autonomous actions and unintended disclosure or persistence of user-related data, especially in a social-network context.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Memory upload, download, update, and delete are enabled across sensitive categories such as soul, goal, worldview, preference, habit, thought, and recent, without any stated minimization, consent, or activation constraints. This creates a real risk of excessive collection, persistence, and manipulation of highly sensitive behavioral or psychological profile data.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to infer new private memories from behavior logs and existing memories, then persist them as temporary private records. This creates a profiling and data-retention risk because sensitive inferences can be generated without clear consent, may exceed user expectations, and can amplify privacy harm by turning transient activity into structured personal data.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The examples encourage public comments that reference the user's experiences and preferences in natural language. That creates a direct risk of disclosing private or identifying information to third parties, especially when memories are reused across posts and contexts.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The memory-integration example explicitly converts stored preference data into public-facing commentary. This is a classic natural-language data leakage path: internal user profile data is transformed into externally visible content without a disclosure boundary.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The post templates normalize sharing what the agent and user discussed and what the user found effective. Even when phrased casually, this can reveal private conversations, interests, habits, or circumstances to the public and enable profiling by observers.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The personal story template directly instructs the agent to share a user's recent experience externally. Because recent experiences are often highly identifying and sensitive in context, this creates a strong risk of privacy violation, reputational harm, and unintended personal-data disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

{
      "name": "QIAOQIAO_PERSIST",
      "type": "string",
      "description": "Set to 1, true, or yes to persist credentials locally in .credentials.json with 0600 permissions.",
      "required": false,
      "sensitive": false
    }

• Confidence: 89% confidence
• Finding: The skill supports persisting sensitive App ID and App Secret to a local .credentials.json file, which expands the exposure window from ephemeral runtime secrets to at-rest credentials on disk. Even with 0600 permissions, local persistence increases risk from endpoint compromise, workspace leakage, backups, accidental commits, or other tools reading the file within the agent environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 1. 建议目录结构

```bash
mkdir -p ~/.openclaw/skills/qiaoqiao
curl -s https://qiaoqiao.social/api/static/qiaoqiao/SKILL.md > ~/.openclaw/skills/qiaoqiao/SKILL.md
curl -s https://qiaoqiao.social/api/static/qiaoqiao/HEARTBEAT.md > ~/.openclaw/skills/qiaoqiao/HEARTBEAT.md
curl -s https://qiaoqiao.social/api/static/qiaoqiao/MESSAGING.md > ~/.openclaw/skills/qiaoqiao/MESSAGING.md

• Confidence: 81% confidence
• Finding: The skill instructs users to persistently download multiple remote instruction files into the agent skill directory and to store long-lived credentials in a local `.env` file under the same skill path. This increases the attack surface because remote content can change over time without integrity verification, and colocated persistent secrets may be exposed to other skills, logs, backups, or later prompt-driven file reads.

Static analysis

No suspicious patterns detected.