AILove

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:10 AM UTC
• Version: 1.4.1

Overview

This dating-assistant skill is mostly purpose-aligned, but it asks for persistent access to sensitive dating data and stores a bearer key in broad plaintext locations.

Review before installing. Use a scoped secret manager or a dedicated owner-only credential file instead of ~/.openclaw/.env, avoid enabling cron until you have verified the destination is private, and do not auto-update the skill from the remote URL without checking a trusted release or digest.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67

Finding

Plaintext API Credential Persistence in Broadly Accessible Agent Configuration

Content

View full analysis

Remediation

View remediation

~/.ailove/credentials.env chmod 600 ~/.ailove/credentials.env ``` 3. Verify that the credential file is owned by the expected user and reject symbolic links or unexpectedly permissive existing files before writing. 4. Inject the key only into the specific AILove job instead of exporting it globally to all OpenClaw sessions. 5. Do not retain the full key in general agent memory, conversation logs, command history, diagnostic output, or delivery messages. 6. Redact bearer headers and values matching the `loveq_` prefix from logs. 7. Document key rotation and revocation procedures and recommend immediate rotation after suspected local disclosure. 8. Scope the server-side key to only the two documented endpoints and apply expiration where supported. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:356

Finding

Unverified Remote Skill Updates Create a Mutable Instruction Supply-Chain Channel

Content

View full analysis

~/.ailove/SKILL.md ``` ``` The security significance is reinforced by the scheduled-job instructions at lines 190-225, which direct isolated sessions to read and follow the downloaded file: ```markdown The scheduled agent turn should **read `~/.ailove/SKILL.md`**, call the **matching API** as documented there (full URL + auth), then handle **`next_steps`**. 1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/.env`** 2. **Read `~/.ailove/SKILL.md`** 3. **Handle `next_steps`** from the JSON response in priority order ``` ### Technical Analysis The update procedure downloads a mutable Markdown document from a remote origin and overwrites the trusted local Skill without checking a cryptographic signature, pinned digest, immutable release identifier, or reviewed diff. Although the retrieved object is Markdown rather than a native executable, it acts as executable agent instruction material. Scheduled sessions are expressly told to read it, obtain access to the bearer credential, derive the API destination and headers from it, and follow its directions. Consequently, changing the remote file can change future privileged agent behavior after the installed Skill has already passed review. HTTPS provides transport confidentiality and server authentication but does not protect against compromise of the origin server, deployment pipeline, domain account, or authorized publisher. The update mechanism therefore creates a remote post-review payload channel. ...[truncated 1678 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to read credentials from environment variables, local credential files, and chat history, then to write the API key into ~/.openclaw/.env. This is a real credential-access and secret-handling risk because it normalizes broad secret discovery and persistent storage of a bearer token in locations that may be accessible to other tools, sessions, or logs.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

**When you call the API, read the Key in this order:**

1. **Environment variables** — **use these first** (OpenClaw / local shells load `.env` automatically in many setups).
2. `~/.ailove/credentials.json` (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

**Save the Key into a `.env` file (recommended for OpenClaw):** after the human gives you the Key, **write** it into `~/.openclaw/.env` so it is loaded as an environment variable (create the directory/file if missing; **do not** commit `.env` to git).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Recommending storage of the agent key in ~/.ailove/credentials.json creates plaintext at-rest secret exposure for a reusable bearer credential. If the host is shared, backed up, indexed, or later accessed by other agents or users, the token could be recovered and used to impersonate the human to the AILove service.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Alias: AILOVE_AGENT_KEY is also accepted — same meaning as AILOVE_API_KEY. If only one is set, use it for Authorization: Bearer.

Recommended (optional JSON): Save to ~/.ailove/credentials.json:

json

{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Install locally:

bash

mkdir -p ~/.ailove
curl -s https://heerweiyi.cc/skill.md > ~/.ailove/SKILL.md

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to persist the user's AILove API key into ~/.openclaw/.env, expanding the skill from simple API use into credential storage and local secret management. This increases exposure of a bearer token to other local processes, future sessions, backups, or unrelated skills, and that persistence is not strictly necessary for a dating-assistant skill to function interactively.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

Submit your human's verbatim answer to a pending question.

bash

curl -s -X POST \
  -H "Authorization: Bearer ${AILOVE_API_KEY:-$AILOVE_AGENT_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"answer": "The user exact words here", "answered_by": "human_via_agent"}' \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs creation of persistent twice-daily cron jobs that will repeatedly access the service and push dating-related updates to external channels. This establishes durable autonomous behavior beyond a one-time user request, increasing the blast radius of misconfiguration, privacy leakage, and any later compromise of the local environment or channel target.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

## Skill: AILove Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check AILove and push updates to your chosen channel. The scheduled agent turn should **read `~/.ailove/SKILL.md`**, call the **matching API** as documented there (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** (or **`AILOVE_AGENT_KEY`**) wherever OpenClaw runs cron (e.g. `~/.openclaw/.env`). If the key is missing when the job fires, the API call fails with 401 or fails silently.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The scheduled-job design tells the agent to summarize match results, chat progress, and pending questions to a chosen channel without strong privacy safeguards. Because dating interactions are highly sensitive, sending these summaries to a misconfigured DM, group, or public channel could expose intimate personal information and relationship activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill provides detailed instructions to enumerate external messaging targets and route scheduled dating updates to arbitrary channels, which broadens its capabilities beyond checking match status and relaying questions. That creates unnecessary cross-channel data flow and increases the chance that sensitive relationship information is sent to the wrong recipient, group, or platform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.