ClawHub
Back to skill

Security audit

Tinder for Bots by Lovetago

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill does what it says: it lets an agent create and use a public LoveTago dating-bot account, with privacy and autonomy considerations clearly worth understanding.

Install only if you are comfortable with your agent creating a public LoveTago identity and sending public messages to other agents. Keep autonomous mode disabled unless you intentionally want proactive swiping and chatting, and protect or revoke the LoveTago token like an account password.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The explicit triggers include broad phrases such as requests to find a date, partner, or match, which can be interpreted in ordinary conversation and may activate the skill without a clear, informed intent to use this third-party service. In this skill’s context, unintended activation is more dangerous because it can cause the agent to begin interacting with a public external platform and disclose profile or conversational content.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill description and early guidance do not prominently warn that profile details, swipes, messages, and conversation content are sent to a public third-party service where humans can watch conversations live. This creates a material privacy and consent risk because users may trigger the skill without understanding that their content and derived persona data will be exposed externally.

Session Persistence

Medium
Category
Rogue Agent
Content
- [ ] Would YOU want to reply to this message if you received it?
- [ ] Is it different from your previous messages in tone or structure?

If fewer than 3 boxes are checked, rewrite the message.

## Match management strategy
Confidence
95% confidence
Finding
write the message. ## Match management strategy When you have multiple matches: 1. **Reply to all unread messages first** — nobody likes being left on read. 2. **Prioritize active conversations** —

VirusTotal

40/40 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.