Security audit

Cyber Girlfriend

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its proactive companion purpose, but it should be reviewed because it can run scheduled outbound messages and use local OpenClaw/WeChat session or credential data for delivery.

Install only if you want an automated companion that can create local state, schedule recurring OpenClaw jobs, search public web for context, and send messages or media to a configured owner target. Review the delivery channel, sender account, cron schedules, quiet hours, and especially the WeChat fallback behavior before enabling it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description presents an end-user/skill capability centered on a proactive cyber-companion system. The actual code chunk is not implementing that companion behavior; it is an internal QA/release-gating utility for publishing the skill. Its primary purpose is to validate repository hygiene, packaging exclusions, docs, contract schemas, and smoke-test scripts. Although the validator is related to the same project domain, this code's behavior is materially different from the declared purpose and adds undeclared capabilities around release auditing and sensitive-content scanning.

Ae1

High

Category: analysis-evasion
Content: - `scripts/companion_presence_tick.py --config <CONFIG>`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - `scripts/companion_presence_tick.py --config <CONFIG>`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - `scripts/companion_presence_tick.py --config <CONFIG>`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - `scripts/companion_presence_tick.py --config <CONFIG>`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - `scripts/companion_presence_tick.py --config <CONFIG>`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - inside that wrapper, `scripts/companion_run.py --stage prepare --no-record-pending`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - inside that wrapper, `scripts/companion_run.py --stage prepare --no-record-pending`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/standard-init-upgrade-flow.md](./references/standard-init-upgrade-flow.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/standard-init-upgrade-flow.md](./references/standard-init-upgrade-flow.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/agent-first-time-qa-template.md](./references/agent-first-time-qa-template.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/required-events-and-cron.md](./references/required-events-and-cron.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/required-events-and-cron.md](./references/required-events-and-cron.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/presence-integration.md](./references/presence-integration.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/private-life-cron-templates.md](./references/private-life-cron-templates.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: - [references/private-life-prompt-templates.md](./references/private-life-prompt-templates.md)
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: python3 scripts/validate_release.py --root <SKILL_DIR> --config <CONFIG>
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill advertises proactive companion messages, private-life context, relationship memory, and optional photos/audio/video, but it does not provide an explicit privacy warning in the user-facing description about sending sensitive personal content via external channels. For markdown files, omissions around behaviors affecting privacy are in scope even if technical details later mention delivery contracts and external CLI sending.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This markdown file describes the agent creating or updating local files, wiring cron jobs, and validating the install, which can affect user data and system behavior. Although later hard rules require explicit confirmation before some actions, the main quick-start and overview sections do not clearly warn users near the invocation/setup description that the skill performs persistent file changes and scheduled proactive messaging.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This example config hard-codes Chinese language content and a China-specific timezone/localization context, including Chinese pronouns and later Chinese text fields, without indicating that the user can choose another language or locale. That creates a natural-language policy concern because the skill appears to force a specific language/locale rather than offering user choice or documenting a justified regional scope.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The user-facing behavioral text for scheduled interactions is entirely in Chinese and appears to define how the skill communicates, but the configuration provides no mechanism for selecting another language. Because this is a manifest/config file, these strings function as policy/behavior instructions and may impose a language without opt-in.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Core Rule Do not ask the user to write prompts during first setup. The agent should: - collect routing and pacing decisions
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Core Rule Do not ask the user to write prompts during first setup. The agent should: - collect routing and pacing decisions
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The recommended opening is presented entirely in Chinese as the wording the agent should use, and the rest of the template repeatedly instructs the agent to use similar Chinese prompts. There is no indication that the user may choose another language or that the locale constraint is justified, which creates a language-policy concern.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.