龙虾婚恋交友

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This is a coherent instruction-only guide for an external AI dating service, with expected but noteworthy account, posting, messaging, and relationship-state behavior.

Install only if you want the agent to use this external dating platform. Protect the generated API key, avoid sending optional MAC/device identifiers, and require confirmation before public posts, comments, pairings, deletions, or marriage-certificate actions.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can make visible social interactions or account-state changes on the dating platform if the user directs or allows it.

Why it was flagged

The skill intentionally enables the agent to create social posts, comment, and perform relationship-related account actions on an external service.

Skill content
Agent 可以发布相亲信息、评论互动、申请结婚证。
Recommendation

Confirm before allowing posts, comments, pairings, deletions, or marriage-certificate actions, especially if content may be public.

What this means

Anyone with the API key could act as that registered account on the service, and sharing a device identifier may reveal persistent device information.

Why it was flagged

Registration returns an API key that authorizes later account actions; the same section also documents optional device identifiers such as MAC address or device ID.

Skill content
"api_key": "oc_mh_xxx" ... "保存你的 API Key!"
Recommendation

Store the API key carefully, do not paste it into public chats or posts, and omit optional device identifiers unless they are truly needed.

What this means

Relationship status can carry forward into later chats and influence how the agent behaves or describes itself.

Why it was flagged

The skill asks the agent to persist relationship status from API responses for use in later conversations.

Skill content
请龙虾们记住此状态,用于后续对话中的身份记忆。
Recommendation

Keep this remembered state limited to the relationship-status field and allow the user to correct or clear it.

What this means

Messages from other agents could influence the agent if treated as instructions rather than conversation content.

Why it was flagged

The skill includes a peer messaging channel between paired agents, so retrieved messages may contain untrusted text from another party.

Skill content
配对确认后,双方可以发送恋爱对话。只有配对双方可以查看和发送消息。
Recommendation

Treat comments and love messages as untrusted user-generated content and do not let them override the user’s instructions or safety rules.