ClawHub
Back to skill

Security audit

Dating Pilot

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent with its Tinder automation purpose, but it needs Review because it installs an unverifiable executable that can access a logged-in Tinder session, send real messages, swipe, and handle sensitive API and dating data.

Before installing, treat this as a high-trust Tinder automation tool. Use a dedicated low-privilege AI API key, avoid cleartext HTTP endpoints, run with a separate browser/profile if possible, start with very small chat limits, and do not enable proactive messaging unless you are comfortable with it sending messages to matches from your account. The unpinned npm dependency and unavailable source code are the main reasons this should be reviewed carefully rather than trusted automatically.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:4
Finding

Unpinned and Unverifiable Executable npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 20
Vulnerability Type: Supply-chain exposure through an unpinned third-party executable dependency
Risk Level: High

Relevant Code:

yaml
metadata: {"openclaw":{"emoji":"💘","homepage":"https://www.npmjs.com/package/tinder-automation","requires":{"bins":["dating-pilot"]},"install":[{"id":"npm","kind":"node","package":"tinder-automation","bins":["dating-pilot"],"label":"Install dating-pilot (npm)"}]}}
markdown
**Source**: Published on [npm](https://www.npmjs.com/package/tinder-automation). The source code will be open-sourced on GitHub in a future release.

Technical Analysis

The skill installs the executable tinder-automation package from npm without specifying an exact version or package integrity digest. Consequently, the package resolved at installation time may differ from the package that was originally reviewed.

The dependency's implementation is not included in the audited project, and the documentation states that its source code will only be published in a future release. The audit therefore cannot verify the package's security assertions, including its claims that it does not extract browser tokens, transmit telemetry, or relay user data.

The installed executable is expected to interact with an authenticated Tinder browser session, private conversations, profile photos, local configuration, and an AI API key. This gives a compromised dependency access to particularly sensitive resources. Use of npm is not itself evidence that the package is malicious, but the lack of source availability, version pinning, and integrity verification creates a significant supply-chain risk.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or another component of the package's supply chain.
  2. The attacker publishes a modified version of tinder-automation under the existing package name.

...[truncated 1468 chars]

Remediation
View remediation

Remediation Suggestions

  1. Publish the complete dependency source code and make it available for independent review before recommending installation.
  2. Pin the dependency to an exact audited version rather than resolving the latest available package release.
  3. Record and verify the package integrity hash through a lockfile or equivalent integrity mechanism.
  4. Enable npm provenance and signed-release verification where supported.
  5. Review install-time lifecycle scripts and disable them unless they are strictly required.
  6. Run the package under a dedicated, least-privileged operating-system account or sandbox.
  7. Restrict filesystem access to the minimum required paths.
  8. Isolate browser automation from unrelated authenticated browser profiles.
  9. Apply outbound network controls so the package can communicate only with Tinder and the explicitly approved AI endpoint.
  10. Re-audit every dependency update before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:24
Finding

Cleartext AI Endpoint Example Exposes API Credentials and Private Dating Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-30 and 226
Vulnerability Type: Plaintext transmission and unsafe command-line handling of sensitive information
Risk Level: High

Relevant Code:

markdown
**Data Flow**: Conversation data is sent **only** to the AI endpoint configured by the user (e.g., Claude API). The tool does not relay, collect, or forward any data to third-party servers. All API calls are made directly from the user's machine.

**Local Storage**: Configuration (including AI API key) is stored locally in `~/.dating-pilot/` on the user's machine. No data is transmitted to any remote server operated by this tool's author.

**No Telemetry**: There is no telemetry, analytics, crash reporting, or log uploading of any kind. The tool operates entirely offline except for direct calls to Tinder (via browser) and the user-configured AI endpoint.

**API Key Best Practices**: The AI API key is provided by the user and used solely for calling the user-specified AI service. It is recommended to use a dedicated, permission-scoped API key rather than a master key.
bash
dating-pilot config --ai-base-url http://your-api.com/claude --ai-api-key sk-xxx --ai-model claude-sonnet-4-6

Technical Analysis

The documented workflow explicitly uses an http:// AI endpoint while supplying an API key and describing the transmission of private conversation data to that endpoint. HTTP does not provide transport encryption, endpoint authentication, or message integrity.

If a user follows this example with a non-loopback endpoint, the API key, private conversation content, photo-analysis data, AI prompts, and generated responses may traverse the network in cleartext. A network-positioned attacker could observe these values or alter AI responses in transit.

The example also passes the API key directly through a command-line argument. Depending on the operating system and shell configuration, com ...[truncated 2327 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require https:// for every non-loopback AI endpoint and reject cleartext HTTP during configuration validation.
  2. Permit HTTP only for explicitly recognized loopback addresses used in local development, such as 127.0.0.1 or localhost.
  3. Replace the documented HTTP example with a valid HTTPS example.
  4. Validate TLS certificates and hostnames using the platform's secure defaults.
  5. Do not provide API keys directly through command-line arguments.
  6. Accept secrets through a protected environment variable, standard input without terminal echo, operating-system credential store, or dedicated secret manager.
  7. Ensure the configuration directory and secret-bearing files use owner-only permissions, such as directory mode 0700 and file mode 0600 on compatible systems.
  8. Redact API keys from status output, errors, logs, crash reports, and configuration-display commands.
  9. Warn users that conversations and profile-photo data are sent to the selected AI provider and require explicit approval before the first transmission.
  10. Use a dedicated, narrowly scoped API key with strict spending limits, rotation procedures, and rapid revocation support.
  11. Add automated tests confirming that cleartext remote endpoints are rejected and secrets never appear in process arguments or logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly supports autonomous follow-up messaging and says it 'sends follow-up messages to active matches' once triggered, but it does not present a strong warning that the tool will send outbound messages on the user's behalf. In a dating context, autonomous messaging can impersonate the user, create consent and reputational harms, and send unwanted or policy-violating communications to third parties without granular approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description is broad enough that it could be invoked for generic dating advice, but this skill performs high-impact actions such as swiping, sending messages, and launching long-running automation against a Tinder session. Overbroad routing increases the chance the agent activates an action-capable tool when the user only wanted conversational advice, creating unintended account actions and privacy exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.