Security audit

AILove

Security checks for vulnerabilities and agentic risk

Overview

This dating assistant is not clearly malicious, but it asks for persistent credential storage and scheduled delivery of sensitive dating updates, so users should review it carefully before installing.

Install only if you want this skill to access AILove repeatedly and send dating updates to configured channels. Prefer a platform secret store or manually managed environment variable over agent-written plaintext files, use a dedicated revocable API key, choose private delivery targets, review cron jobs before enabling them, and know how to disable the jobs and rotate the key.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to write secrets into a global OpenClaw config file (`~/.openclaw/.env`) and later read from it, which expands the skill's scope from dating assistance into management of shared host-level credentials. That creates unnecessary cross-skill exposure and increases the chance that other jobs, tools, or users on the same system can access or misuse the dating account token.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest presents a dating assistant, but the body additionally directs the agent to create cron jobs, inspect channel directories, edit job state, and deliver messages to third-party channels. This broadens the agent's authority beyond the advertised purpose and can cause users to grant automation and messaging capabilities they did not expect, increasing the blast radius of mistakes or abuse.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill recommends persisting the agent key in `~/.openclaw/.env`, which places a reusable impersonation token on disk. Although the document says not to commit the file to git, it does not adequately address local disclosure risks such as other processes, backups, shell history, multi-user systems, or accidental file sharing.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The scheduled push feature tells the agent to forward matching progress, deep questions, results, and related updates into external channels, but it does not clearly warn that this may disclose highly sensitive romantic and behavioral data to third-party messaging platforms or unintended recipients. Because the content concerns dating activity, even routine summaries can create serious privacy harm if misrouted or visible in group contexts.

Session Persistence

Medium

Category: Rogue Agent
Content: ## Skill: AILove Scheduled Push Configuration Create **two** cron jobs (morning + evening) that check AILove and push updates to your chosen channel. The scheduled agent turn should **read `~/.ailove/SKILL.md`**, call the **matching API** as documented there (full URL + auth), then handle **`next_steps`**. **Environment (required):** Export **`AILOVE_API_KEY`** (or **`AILOVE_AGENT_KEY`**) wherever OpenClaw runs cron (e.g. `~/.openclaw/.env`). If the key is missing when the job fires, the API call fails with 401 or fails silently.
Confidence: 90% confidence
Finding: The skill instructs creation of persistent cron jobs that repeatedly read local files, use stored credentials, call remote APIs, and push outputs to channels. Persistent automation materially increases risk because any misconfiguration, compromised token, or privacy leak can recur automatically without fresh human review, and the isolated-session design may make users less aware of what is being sent.

Static analysis

No suspicious patterns detected.