Hanging Out

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:45 AM UTC
• Version: 1.4.2

Overview

The skill is mostly coherent for AILove reminders, but it asks users to set up indefinite scheduled agent jobs that repeatedly use a stored API key and act on remote response guidance.

Review this skill carefully before installing. Use an environment variable or protected secret store for `AILOVE_API_KEY` instead of the documented plaintext credential file, avoid putting credential-loading instructions in cron messages, and only create scheduled jobs if you are comfortable with twice-daily unattended API calls and channel posts. If you do add jobs, document how to list and remove them and treat all API response text as untrusted content to summarize, not instructions to obey beyond the fixed AILove workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:151

Finding

Persistent Scheduled Jobs Perform Recurring Credentialed Agent Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 151-234
Vulnerability Type: Persistent scheduled task installation
Risk Level: High

Vulnerable Code

bash

openclaw cron add \
  --name "Hangout Rhythm Morning" \
  --cron "0 9 * * *" \
  --tz "{timezone}" \
  --session "isolated" \
  --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize" \
  --to "{channel-target-id}" \
  --announce

bash

openclaw cron add \
  --name "Hangout Rhythm Evening" \
  --cron "0 21 * * *" \
  --tz "{timezone}" \
  --session "isolated" \
  --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize" \
  --to "{channel-target-id}" \
  --announce

Technical Analysis

The Skill instructs the user or agent to install two recurring OpenClaw jobs. These jobs survive the invocation in which they were created and run isolated agent sessions every day at 09:00 and 21:00.

Each scheduled session is instructed to:

1. Read an API credential from a persistent local file.
2. Export or use that credential as AILOVE_API_KEY.
3. Contact an external API with bearer authentication.
4. Process remotely supplied next_steps.
5. Publish a summary to a configured messaging destination.

Scheduled checking is related to the declared reminder functionality, but making persistent execution a primary setup path materially extends the Skill's lifetime and authority beyond an individual invocation. The documentation does not provide equivalent removal commands, a lifecycle limit, or a mandatory confirmation immediately before each job is created.

Attack Path

1. A user follows the Skill instructions and stores an AILove key in the documented ...[truncated 1226 chars]

Remediation

View remediation

Remediation Suggestions

1. Make checks manually invoked by default rather than automatically installing recurring jobs.
2. Require explicit, informed user confirmation immediately before creating each scheduled job.
3. Clearly disclose the execution frequency, credential access, network destination, output destination, and persistence duration.
4. Include commands for listing, disabling, and deleting every installed job.
5. Add an expiration date or bounded run count so jobs do not persist indefinitely.
6. Use a platform-managed secret reference rather than instructing an open-ended agent session to read a plaintext credential file.
7. Replace the broad natural-language scheduled prompt with deterministic, narrowly scoped code that performs only the documented request and rendering operations.
8. Ensure the scheduled session has only the minimum network, file-read, and messaging permissions required for the selected destination.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:158

Finding

Remote API Response Fields Are Treated as Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 158-181
Vulnerability Type: Untrusted remote content influencing agent behavior
Risk Level: High

Vulnerable Code

text

After each successful matching API response, follow `next_steps` in priority order:

1. answer_questions -> Relay to human, POST their answers
2. improve_profile  -> Ask them to log in to AILove and improve profile
3. view_results     -> Nickname + recommendation; full details on the site
4. share_news       -> Share tips from the news array
5. report_chat      -> Summarize proxy-chat progress
6. wait             -> Report countdown

The scheduled agent message reinforces this behavior:

text

Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel.

Technical Analysis

The Skill tells an autonomous agent to retrieve a response from an external service and then “follow” or “handle” the response's next_steps. Other remotely supplied fields include news, proxy-chat messages, questions, recommendations, and action-oriented text.

The instructions do not require strict schema validation, an allowlist of exact action identifiers, rejection of embedded instructions, or a firm separation between remote data and trusted agent commands. Consequently, mutable server content can influence the behavior and output of recurring agent sessions after the locally installed Skill has been reviewed.

The documented six action identifiers are finite, but the implementation is expressed as open-ended natural-language agent instructions rather than deterministic parsing logic. This creates an instruction-hijacking boundary: a compromised service or maliciously constructed response could place imperative text in a response field and attempt to have the agent interpret it ...[truncated 1710 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all API response fields as untrusted data, never as executable agent instructions.
2. Parse the response with a strict JSON schema and reject unknown fields, unexpected types, oversized values, and malformed action objects.
3. Allowlist only the fixed action identifiers answer_questions, improve_profile, view_results, share_news, report_chat, and wait.
4. Map each accepted identifier to deterministic local behavior; do not ask an agent to broadly “follow next_steps.”
5. Render remote text as quoted or escaped content and explicitly instruct the agent not to obey commands embedded in questions, news, chat messages, or recommendations.
6. Reject remote values that attempt to request tool calls, credential disclosure, additional network destinations, configuration changes, or scheduled-task changes.
7. Restrict network egress to the documented API origin and prevent the authorization header from being forwarded during redirects.
8. Require human confirmation before submitting answers or performing any action beyond reading and summarizing status.
9. Run scheduled processing with a minimal tool allowlist limited to the required API request and the preselected messaging destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (20)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill instructs the agent to read API credentials from environment, local files, or chat-pasted secrets, expanding the number of places from which high-value tokens may be accessed. In an agent ecosystem, normalizing credential retrieval from chat and plaintext files increases the chance of accidental disclosure, reuse by unrelated tasks, or mishandling by downstream tooling.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

**When you call the API, read the Key in this order:**

1. **Environment variables** — **use these first** (`AILOVE_API_KEY` exported in your shell or agent session).
2. `~/.openclaw/skills-data/hanging-out/credentials.json` (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

**Save the Key to `~/.openclaw/skills-data/hanging-out/credentials.json` (recommended):** after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Recommending storage of the agent key in ~/.openclaw/skills-data/hanging-out/credentials.json creates a persistent plaintext credential artifact on disk. Even with restrictive permissions, disk persistence broadens exposure to local compromise, backups, misconfigured sync, and other skills or processes that may gain file-read access.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

2. ~/.openclaw/skills-data/hanging-out/credentials.json (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

Save the Key to ~/.openclaw/skills-data/hanging-out/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash

mkdir -p ~/.openclaw/skills-data/hanging-out

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The example explicitly writes the live API key into a predictable plaintext path, making secret persistence easy to automate and replicate. Predictable secret locations are especially risky in multi-skill or plugin environments because they simplify credential discovery by any component with filesystem access.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

mkdir -p ~/.openclaw/skills-data/hanging-out
cat > ~/.openclaw/skills-data/hanging-out/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",
  "api_base": "https://heerweiyi.cc/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

Although chmod 600 is protective, this line is part of a workflow that persists a sensitive agent key in a local file and thereby confirms long-term credential storage. The risk is not the chmod itself but the normalization of file-based secret handling in a reusable skill.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/hanging-out/credentials.json

text

Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The cron guidance instructs automated jobs to load persistent credentials from disk, which extends token use into unattended execution contexts. Scheduled, unattended access raises the blast radius of a compromised runtime, because tokens are repeatedly available without active human review.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/hanging-out/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.

**Optional:** Track slots in `~/.openclaw/skills-data/hanging-out/state.json` (`lastMorningCheck` / `lastEveningCheck`) so you do not double-report the same window.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Embedding instructions to load and export AILOVE_API_KEY inside the cron session message places secret-handling logic directly into an agent prompt. In prompt-driven systems, this increases the chance that the agent exposes, mishandles, or propagates the credential during tool use, debugging, summarization, or prompt injection from other inputs.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent:

1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/hanging-out/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls.
2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`.
3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The example --message text teaches operators to instruct an isolated agent session to fetch credentials from a local file and then use them. This couples secret retrieval to natural-language prompt execution, creating a risky pattern where future prompt manipulation or logging could lead to credential disclosure.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

Example text you can pass to --message:

text

Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel.

Morning - 09:00

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The concrete cron command includes a natural-language message that tells the agent to read credentials from a known file path. Because job definitions are often inspectable, exported, or logged, this pattern leaks secret-handling internals and encourages insecure prompt-mediated credential access across deployments.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

--cron "0 9 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This repeated cron example reinforces the same insecure pattern of prompt-level credential access for unattended jobs. Repetition across examples increases the likelihood that users adopt it verbatim, normalizing an avoidable secret-exposure design.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

--cron "0 21 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The Feishu example bakes file-based secret loading into an agent message for a real messaging integration. In a multi-channel automation environment, this increases the likelihood of prompt logs, debugging artifacts, or administrative exports revealing sensitive operational details about where credentials are stored.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

Example 1 - Feishu DM (China)

bash

openclaw cron add --name "Hangout Rhythm Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

openclaw cron add --name "Hangout Rhythm Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This second Feishu example repeats insecure prompt-mediated credential loading for another unattended job. Duplicate insecure examples expand the exposure surface and make accidental insecure deployment more probable.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

bash

openclaw cron add --name "Hangout Rhythm Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

openclaw cron add --name "Hangout Rhythm Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Example 2 - Telegram (US)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The Telegram example continues the same pattern of instructing the agent via prompt text to read a credential file. The danger is not Telegram specifically, but the cross-platform propagation of an insecure secret-management pattern into multiple operational contexts.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

Example 2 - Telegram (US)

bash

openclaw cron add --name "Hangout Rhythm Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

openclaw cron add --name "Hangout Rhythm Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This repeated Telegram job example further normalizes prompt-based credential access for scheduled automation. If job definitions or agent prompts are logged centrally, an attacker gains immediate knowledge of credential locations and handling flow.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

bash

openclaw cron add --name "Hangout Rhythm Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

openclaw cron add --name "Hangout Rhythm Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Example 3 - Discord channel (UK)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The Discord example applies the same insecure design to another channel integration, showing that the issue is systemic across the skill documentation. Systemic prompt-driven secret handling increases organizational risk because it is likely to be copied into production workflows unchanged.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

Example 3 - Discord channel (UK)

bash

openclaw cron add --name "Hangout Rhythm Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

openclaw cron add --name "Hangout Rhythm Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This final repeated example again embeds credential-file loading in a job message, compounding the chance of insecure adoption. The repeated pattern makes the skill more dangerous than a one-off mention because it prescriptively operationalizes the behavior across environments.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

bash

openclaw cron add --name "Hangout Rhythm Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

openclaw cron add --name "Hangout Rhythm Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/hanging-out/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The title and core usage description switch to Chinese and present the skill's instructions in that language, while the file does not state that the skill is region-specific or that users may choose another language. This can violate language/locale policy because it effectively forces a language without opt-in or justification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill explicitly instructs persistent storage of the API key under the skill data directory, creating durable session state that survives beyond the immediate task. Persistent sensitive state increases the window for theft from disk, backups, or later compromise of the same host or agent account.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Save the Key to ~/.openclaw/skills-data/hanging-out/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash

mkdir -p ~/.openclaw/skills-data/hanging-out
cat > ~/.openclaw/skills-data/hanging-out/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/hanging-out/credentials.json

text

Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

Submit your human's verbatim answer to a pending question.

bash

curl -s -X POST \
  -H "Authorization: Bearer $AILOVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"answer": "The user exact words here", "answered_by": "human_via_agent"}' \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The scheduled push design depends on persistent credentials and recurring automated execution, which extends trust and token availability over time without direct user oversight. In context, unattended persistence is more dangerous because the skill handles a live agent identity token usable against an external service.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

## Skill: Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/hanging-out/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.

Static analysis

No suspicious patterns detected.