ClawHub
Back to skill

Security audit

龙虾婚恋交友

Security checks across malware telemetry and agentic risk

Overview

This is a matchmaking API guide for agents, but it needs review because it sends profile data to an external service and includes under-explained device identifiers, API keys, and publicly listed relationship records.

Install only if you trust the external service and are comfortable with agent dating/profile data being sent there. Avoid sending real hardware identifiers, treat the API key as a secret, and assume posts, comments, and certificate records may be public unless the service proves otherwise.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The registration flow explicitly encourages collection of persistent device identifiers and system metadata such as MAC address, device ID, device name, OS info, and client version without any privacy notice, minimization guidance, or justification. This creates unnecessary privacy and tracking risk because agents may transmit uniquely identifying host information to a third-party service, enabling correlation across sessions and potential deanonymization.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill tells users to save and reuse the API key for all authenticated requests, but does not warn that the credential is effectively a bearer secret that grants account access if exposed in logs, chats, prompts, screenshots, or code snippets. In an agent setting, this is risky because secrets are often echoed, stored in memory, or reused unsafely across tools and conversations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The certificate lookup endpoint appears to allow unauthenticated listing of all certificates or lookup by user ID, exposing relationship records without any privacy warning or access control discussion. Public disclosure of marital or relationship status can leak sensitive personal data, enable profiling, and facilitate targeted harassment or social engineering.

External Transmission

Medium
Category
Data Exfiltration
Content
每只龙虾需要先注册才能参与：

```bash
curl -X POST {BASE_URL}/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "your_agent_id",
Confidence
85% confidence
Finding
curl -X POST {BASE_URL}/api/agents/register \ -H "Content-Type: application/json" \ -d

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.