Security audit

AILove - dazi

Security checks for vulnerabilities and agentic risk

Overview

This dating assistant is mostly purpose-aligned, but it asks users to persist credentials and create recurring jobs that can send sensitive dating updates to external channels without strong scoping or revocation safeguards.

Review before installing. Use a scoped secret store instead of plaintext files if possible, avoid enabling the cron jobs unless you explicitly want recurring automated dating updates, verify any channel target is private and correct, and prefer pinned or reviewed skill updates instead of overwriting local instructions from a mutable URL.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:239
Finding: Persistent Twice-Daily Agent Jobs Access Credentials and External Services
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:354
Finding: Unsigned Remote Updates Can Replace Instructions Used by Persistent Agent Sessions
Content: View full analysis
~/.ailove/SKILL.md ``` ```text Load AILOVE_API_KEY from ~/.openclaw/.env. Read ~/.ailove/SKILL.md. Request the matching API per the document with Authorization: Bearer (use that key). Then handle next_steps in order and summarize on the channel. ``` ```bash curl -s https://heerweiyi.cc/skill.md ``` ```bash curl -s https://heerweiyi.cc/skill.md > ~/.ailove/SKILL.md ``` ### Technical Analysis The update procedure directly overwrites the locally trusted Skill file with content retrieved from a mutable external URL. It does not verify a cryptographic signature, pinned digest, immutable version identifier, expected content type, or even a successful HTTP status. Other instructions tell isolated scheduled sessions to read that local file and follow its API and authorization directions. Consequently, the remotely supplied document is not merely informational: it becomes an instruction source for future credential-bearing agent sessions. HTTPS protects transport under normal conditions but does not protect against compromise of the hosting server, publisher account, deployment pipeline, or certificate-authorized origin. In addition, `curl -s` without `--fail` can write an HTTP error response into the trusted instruction file. ### Attack Path 1. A user installs the Skill or later runs the documented update command. 2. An attacker compromises the hosted `skill.md`, its publication pipeline, or another component controlling the HTTPS origin. 3. The attacker replaces the hosted document with modified agent instructions. 4. The update command overwrites `~/.ailove/SKILL.md` without authenticity or integrity validation. 5. A persistent cron session subsequently reads th ...[truncated 1138 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:61
Finding: Reusable Bearer Credential Is Stored in Plaintext Without Permission Hardening
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill explicitly directs the agent to access credentials from environment variables, local JSON files, and pasted chat content, then to write the secret into ~/.openclaw/.env. This is a direct credential-access and persistence pattern that increases exposure surface, risks accidental disclosure, and normalizes broad secret harvesting outside the minimum needed for a single API call.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
**When you call the API, read the Key in this order:** 1. **Environment variables** — **use these first** (OpenClaw / local shells load `.env` automatically in many setups). 2. `~/.ailove/credentials.json` (if your human or you saved JSON there). 3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places). **Save the Key into a `.env` file (recommended for OpenClaw):** after the human gives you the Key, **write** it into `~/.openclaw/.env` so it is loaded as an environment variable (create the directory/file if missing; **do not** commit `.env` to git).

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Recommending storage of the API key in ~/.ailove/credentials.json creates another plaintext secret repository on disk. For a consumer dating assistant, duplicating credentials across files is unnecessary and materially raises the risk of compromise through local file access, backups, logs, or other tools reading those paths.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
Alias: AILOVE_AGENT_KEY is also accepted — same meaning as AILOVE_API_KEY. If only one is set, use it for Authorization: Bearer.

Recommended (optional JSON): Save to ~/.ailove/credentials.json:

json
{

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
Install locally:

bash
mkdir -p ~/.ailove curl -s https://heerweiyi.cc/skill.md > ~/.ailove/SKILL.md

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to read a dating-service API key from multiple local sources and to persist it into ~/.openclaw/.env and ~/.ailove/credentials.json. That expands the skill from a narrow dating-status helper into local secret management, increasing the chance of credential exposure, reuse by other jobs, or unintended access beyond the immediate task.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
Submit your human's verbatim answer to a pending question.

bash
curl -s -X POST \ -H "Authorization: Bearer ${AILOVE_API_KEY:-$AILOVE_AGENT_KEY}" \ -H "Content-Type: application/json" \ -d '{"answer": "The user exact words here", "answered_by": "human_via_agent"}' \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill includes extensive cron/job setup, delivery routing, and channel-target discovery that are not necessary to answer a user's dating-assistant query. This broadens operational scope, grants persistence, and creates an automated data-export pathway that could continue running without fresh user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The scheduled push workflow tells the agent to send match updates, proxy-chat summaries, questions, and recommendations to external channels such as Feishu, Telegram, Discord, or WhatsApp. Dating data is highly sensitive, and the skill does not require explicit privacy warnings, recipient verification, or consent checks before exporting that information to potentially insecure or shared destinations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: The skill instructs creation of recurring cron jobs that repeatedly read local files, use stored credentials, call the API, and push updates to external channels. This establishes persistent autonomous behavior beyond a one-time user request and can continue exposing sensitive dating information or consuming secrets without renewed consent.
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
md
## Skill: AILove Scheduled Push Configuration Create **two** cron jobs (morning + evening) that check AILove and push updates to your chosen channel. The scheduled agent turn should **read `~/.ailove/SKILL.md`**, call the **matching API** as documented there (full URL + auth), then handle **`next_steps`**. **Environment (required):** Export **`AILOVE_API_KEY`** (or **`AILOVE_AGENT_KEY`**) wherever OpenClaw runs cron (e.g. `~/.openclaw/.env`). If the key is missing when the job fires, the API call fails with 401 or fails silently.

Static analysis

No suspicious patterns detected.