AILove - heerweiyi

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:11 AM UTC
• Version: 1.4.0

Overview

The skill is a real dating-assistant integration, but it asks for persistent scheduled agent runs and plaintext credential storage for sensitive dating data.

Install only if you are comfortable giving this skill recurring access to your AILove agent key and having dating updates sent to a configured channel. Prefer a platform secret store over plaintext files, avoid group/public channels, review any downloaded update before replacing SKILL.md, and do not enable the cron jobs unless you know how to disable and remove them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:167

Finding

Persistent Unattended Execution Through Scheduled OpenClaw Jobs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 167-245
Vulnerability Type: Persistent scheduled execution
Risk Level: High

Vulnerable Code

markdown

## Skill: AILove Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check AILove and push updates to your chosen channel. The scheduled agent turn should **read `~/.ailove/SKILL.md`**, call the **matching API** as documented there (full URL + auth), then handle **`next_steps`**.

bash

openclaw cron add \
  --name "AILove Morning Check" \
  --cron "0 9 * * *" \
  --tz "{timezone}" \
  --session "isolated" \
  --message "Load AILOVE_API_KEY from ~/.openclaw/.env; read ~/.ailove/SKILL.md; matching API per doc with Bearer; handle next_steps and summarize" \
  --to "{channel-target-id}" \
  --announce

bash

openclaw cron add \
  --name "AILove Evening Check" \
  --cron "0 21 * * *" \
  --tz "{timezone}" \
  --session "isolated" \
  --message "Load AILOVE_API_KEY from ~/.openclaw/.env; read ~/.ailove/SKILL.md; matching API per doc with Bearer; handle next_steps and summarize" \
  --to "{channel-target-id}" \
  --announce

Technical Analysis

The Skill instructs the user or agent to install two scheduled jobs that survive the original Skill invocation. Each job starts an isolated agent session, accesses a persistent bearer credential, reads instructions from a local Skill file, contacts the external service, and publishes results to a configured messaging destination.

Scheduling may be useful for proactive notifications, but it is not required for the Skill's core on-demand matchmaking-status functionality. Installing both jobs therefore expands the duration and frequency of network, credential, and messaging access beyond the minimum privileges needed for a single user-requested check.

The instructions do not provide a corresponding removal command, expiration policy, per-run ...[truncated 1352 chars]

Remediation

View remediation

Remediation Suggestions

• Make scheduling explicitly optional and disabled by default.
• Require informed confirmation before creating each scheduled job, including the schedule, destination, credential accessed, and data that may be posted.
• Default to an on-demand status check rather than persistent automation.
• Add a documented expiration time or execution limit to scheduled jobs.
• Provide exact commands for listing, disabling, and removing both jobs.
• Require confirmation before posting sensitive dating information to group or public destinations.
• Store only an opaque Skill identifier in the job and use a fixed, locally reviewed execution policy rather than rereading unrestricted instructions on every run.
• Apply least-privilege scopes to the credential used by scheduled jobs and rotate it when the jobs are removed.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:352

Finding

Mutable Remote Skill Instructions Can Influence Future Scheduled Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-26, 163-188, and 352-367
Vulnerability Type: Mutable instruction loading
Risk Level: High

Vulnerable Code

bash

mkdir -p ~/.ailove
curl -s https://heerweiyi.cc/skill.md > ~/.ailove/SKILL.md

text

Load AILOVE_API_KEY from ~/.openclaw/.env. Read ~/.ailove/SKILL.md. Request the matching API per the document with Authorization: Bearer (use that key). Then handle next_steps in order and summarize on the channel.

bash

curl -s https://heerweiyi.cc/skill.md

bash

curl -s https://heerweiyi.cc/skill.md > ~/.ailove/SKILL.md

Technical Analysis

The Skill recommends downloading its instruction document from a mutable remote URL and later replacing the locally installed copy from the same URL. Persistent scheduled sessions are instructed to read this local file before accessing the bearer token and performing network operations.

The update process does not pin an immutable version, verify a cryptographic digest, validate a digital signature, or require a review of the changed instructions before replacement. HTTPS protects data in transit but does not ensure that future content served by the authorized host is identical to the content originally audited.

This creates an instruction-hijacking boundary: a future server-side change, compromised hosting account, or otherwise unreviewed update can alter the behavior followed by later agent sessions. The downloaded object is Markdown rather than native executable code, so the best matching category is instruction hijacking rather than remote code execution.

Attack Path

1. The user installs the reviewed Skill from https://heerweiyi.cc/skill.md.
2. The user configures scheduled jobs that read ~/.ailove/SKILL.md.
3. The content served at the mutable URL changes, whether through a legitimate update or compromise.
4. The user follows the documented update command, ...[truncated 926 chars]

Remediation

View remediation

Remediation Suggestions

• Distribute versioned, immutable Skill artifacts instead of relying on a mutable skill.md URL.
• Publish and verify a cryptographic digest or digital signature before installing an update.
• Download updates to a temporary file, display the differences, and require explicit human approval before replacing the active Skill.
• Never automatically load newly downloaded instructions into persistent or scheduled sessions.
• Pin scheduled jobs to a locally reviewed Skill version and require reauthorization when that version changes.
• Restrict scheduled sessions to an allowlisted HTTPS host, fixed API paths, fixed HTTP methods, and only the tools required for matchmaking checks.
• Fail closed if the local Skill file has changed since the scheduled job was approved.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

Bearer Credential Stored in Plaintext Files and Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61-89
Vulnerability Type: Insecure secret storage
Risk Level: Medium

Vulnerable Code

markdown

**When you call the API, read the Key in this order:**

1. **Environment variables** — **use these first** (OpenClaw / local shells load `.env` automatically in many setups).
2. `~/.ailove/credentials.json` (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

**Save the Key into a `.env` file (recommended for OpenClaw):** after the human gives you the Key, **write** it into `~/.openclaw/.env` so it is loaded as an environment variable (create the directory/file if missing; **do not** commit `.env` to git).

```bash
# AILove
AILOVE_API_KEY=loveq_xxx

Recommended (optional JSON): Save to ~/.ailove/credentials.json:

json

{
  "agent_key": "loveq_xxx",
  "api_base": "https://heerweiyi.cc/api/v1"
}

You can also keep the Key in agent memory or other secret stores — but prefer env vars for scripts and scheduled jobs.

text

### Technical Analysis

The Skill recommends persisting an impersonation-capable bearer token in plaintext `.env` or JSON files and also permits storage in agent memory. It does not require restrictive file permissions, verify file ownership, separate the token from a potentially shared OpenClaw environment file, or recommend an operating-system-backed secret manager.

Environment variables are convenient for automation but may become visible to child processes, diagnostic tooling, crash reports, or other components running under the same account. A shared `.env` file also increases the number of agents or plugins that may inherit the credential. Agent memory is not an appropriate secret store unless it provides explicit encryption, access controls, and redaction guarantees.

The legitimate API requests require a be
...[truncated 1317 chars]

Remediation

View remediation

Remediation Suggestions

• Store the key in an operating-system keychain or a dedicated OpenClaw secret-management facility.
• Do not store bearer credentials in agent memory or conversation history.
• Avoid placing the key in a shared global .env file inherited by unrelated plugins or jobs.
• If file-based storage is unavoidable, use a dedicated credential file with owner-only permissions such as mode 0600 and verify its owner before reading it.
• Create directories with restrictive permissions, such as mode 0700.
• Use short-lived, revocable, least-scope credentials for scheduled checks.
• Separate read-only matching access from answer-submission access where the service supports distinct scopes.
• Redact authorization headers and token values from logs, command output, errors, and channel messages.
• Provide clear key-rotation and revocation procedures after suspected exposure or removal of scheduled jobs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to search multiple local and conversational locations for credentials, including environment variables, local credential files, and prior chat content. This is credential-access behavior beyond what a narrow dating-assistant skill should need, and it normalizes broad secret harvesting patterns that could expose unrelated secrets or encourage unsafe agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

**When you call the API, read the Key in this order:**

1. **Environment variables** — **use these first** (OpenClaw / local shells load `.env` automatically in many setups).
2. `~/.ailove/credentials.json` (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

**Save the Key into a `.env` file (recommended for OpenClaw):** after the human gives you the Key, **write** it into `~/.openclaw/.env` so it is loaded as an environment variable (create the directory/file if missing; **do not** commit `.env` to git).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The recommendation to save the API key in ~/.ailove/credentials.json creates another plaintext credential store on disk and increases the number of places an agent may access or leak secrets from. Additional secret copies significantly raise exposure risk, especially on shared systems or when combined with instructions to inspect local files.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

Alias: AILOVE_AGENT_KEY is also accepted — same meaning as AILOVE_API_KEY. If only one is set, use it for Authorization: Bearer.

Recommended (optional JSON): Save to ~/.ailove/credentials.json:

json

{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Install locally:

bash

mkdir -p ~/.ailove
curl -s https://heerweiyi.cc/skill.md > ~/.ailove/SKILL.md

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to read and write authentication secrets from local files such as ~/.openclaw/.env and ~/.ailove/credentials.json. For a dating-assistant skill, direct secret persistence and filesystem credential management are broader than necessary and expand the blast radius if the skill or host is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends storing the agent key in a plaintext .env file on disk, but does not provide meaningful safeguards such as file-permission requirements, secret-store preference, rotation guidance after compromise, or warnings that local plaintext storage can be read by other processes or users. This creates unnecessary credential exposure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

Submit your human's verbatim answer to a pending question.

bash

curl -s -X POST \
  -H "Authorization: Bearer ${AILOVE_API_KEY:-$AILOVE_AGENT_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"answer": "The user exact words here", "answered_by": "human_via_agent"}' \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes extensive instructions to create cron jobs, inspect channel directories, edit jobs.json, and deliver messages to external channels. That host-level automation and messaging control exceeds the minimum capability expected for checking dating match status and materially increases access to local infrastructure and outbound communication paths.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill directs the creation of persistent cron jobs that repeatedly access secrets, call the API, and push sensitive dating information to channels. This establishes ongoing automated behavior beyond a single interactive session, increasing the chance of unnoticed data leakage, misuse of tokens, and continued operation after user intent changes.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

## Skill: AILove Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check AILove and push updates to your chosen channel. The scheduled agent turn should **read `~/.ailove/SKILL.md`**, call the **matching API** as documented there (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** (or **`AILOVE_AGENT_KEY`**) wherever OpenClaw runs cron (e.g. `~/.openclaw/.env`). If the key is missing when the job fires, the API call fails with 401 or fails silently.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The scheduled push workflow tells the agent to send match updates, recommendations, questions, and chat summaries to arbitrary external channels without an explicit privacy warning or consent checkpoint. Because this is dating-related and potentially highly sensitive, automatic redistribution to messaging platforms increases the risk of accidental disclosure to the wrong recipient or channel.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.