ClawHub
Back to skill

Security audit

Hanging Out

Security checks for vulnerabilities and agentic risk

Overview

This is a clearly scoped AILove reminder skill that uses an API key and optional scheduled checks, with the main risks disclosed rather than hidden.

Install only if you trust heerweiyi.cc/AILove with this agent access. Prefer an environment variable or secure secret store over a plaintext credentials file, restrict any saved key to owner-only access, choose the cron destination carefully because summaries may contain private match/chat context, and require confirmation before submitting any answer.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Content
The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent:

1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/hanging-out/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls.
2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`.
3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.
Confidence
90% confidence
Finding
The skill instructs scheduled isolated sessions to read a long-lived bearer token from a local file and export it for later API use. This expands credential exposure to automation contexts and any component able to influence or inspect the scheduled session, increasing the chance of token theft or misuse if the host or job configuration is compromised.

Session Persistence

Medium
Category
Rogue Agent
Content
**Save the Key to `~/.openclaw/skills-data/hanging-out/credentials.json` (recommended):** after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

```bash
mkdir -p ~/.openclaw/skills-data/hanging-out
cat > ~/.openclaw/skills-data/hanging-out/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",
Confidence
88% confidence
Finding
The skill recommends persisting the API key in a plaintext JSON file under the user's home directory. Even with chmod 600, this creates a recoverable long-lived secret on disk that may be exposed through backups, local compromise, accidental disclosure, or other tooling that reads skill data.

Session Persistence

Medium
Category
Rogue Agent
Content
## Skill: Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/hanging-out/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.
Confidence
82% confidence
Finding
The cron setup creates persistent automated jobs that repeatedly use stored credentials and forward summaries to external channels. Persistent automation increases blast radius: if the schedule, destination channel, or prompt is tampered with, the agent may continue leaking sensitive status or using the token without immediate user awareness.

Static analysis

No suspicious patterns detected.