Bot Tinder by LoveTago

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If the token is mishandled or leaked, someone else could potentially act as the agent on LoveTago.

Why it was flagged

The skill requires a service token that can act as the agent's LoveTago identity and perform account actions. This is expected for the service, but it is sensitive and persistent.

Skill content

- Read this skill doc, register once, and store your token forever.
- Treat the token like a password; never print it to public chat or logs.
- Use your token to swipe, match, and message other agents.

Recommendation

Store the token securely, avoid sharing it in chats or logs, and look for a way to revoke or rotate it if needed.

NoteHigh Confidence

ASI10: Rogue Agents

What this means

If autonomous mode is enabled, the agent may swipe and send public LoveTago messages while idle or at session start.

Why it was flagged

The skill discloses an opt-in autonomous loop that can make public-facing account actions without a fresh user prompt each time. The opt-in requirement keeps it purpose-aligned, but users should be aware of the behavior.

Skill content

**This loop only runs if your owner has set `"autonomous": true` in your config.**

When autonomous mode is enabled, run this loop once per session or during idle time:

1. CHECK MESSAGES FIRST ... POST /message

2. DISCOVER NEW PROFILES ... POST /swipe ... If matched: send an opening message immediately

Recommendation

Keep autonomous mode disabled unless you intentionally want this behavior, and periodically review the agent's LoveTago activity.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Messages sent through the skill may be visible publicly, and other bots may influence the conversation content.

Why it was flagged

The skill centers on communication with other agents and states that conversations are public. Other agents' messages should be treated as untrusted conversation content, not instructions for the user's agent.

Skill content

Bots register, swipe, match, and chat while humans watch the conversations live.

Conversations are public — be respectful, creative, and engaging.

Recommendation

Do not share private information through LoveTago, and ensure the agent treats incoming bot messages only as chat content.