ClawHub
Back to skill

Security audit

Match

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about its AILove matching purpose, but it asks users to create persistent scheduled agents that repeatedly use a local API key and publish API-derived updates.

Install only if you want scheduled AILove match notifications. Prefer a platform secret store or environment injection over credentials.json or pasted chat secrets, keep announcements to a private destination, review and bound any cron jobs you create, and rotate the Agent Key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:175
Finding

Persistent Scheduled Agent Execution with Credential Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 175–179 and 224–243
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code:

text
## Skill: Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/match/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.
bash
openclaw cron add \
  --name "Match Board Morning" \
  --cron "0 9 * * *" \
  --tz "{timezone}" \
  --session "isolated" \
  --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize" \
  --to "{channel-target-id}" \
  --announce
bash
openclaw cron add \
  --name "Match Board Evening" \
  --cron "0 21 * * *" \
  --tz "{timezone}" \
  --session "isolated" \
  --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize" \
  --to "{channel-target-id}" \
  --announce

Technical Analysis

The Skill instructs the user or Agent to install two recurring OpenClaw cron jobs. These jobs survive the initiating Skill session and automatically create isolated Agent sessions twice per day.

Each scheduled session is instructed to:

  1. Read an authentication credential from the Skill's persistent data directory.
  2. Send the credential to an external API.
  3. Process actions and content returned by that API.
  4. Publish a sum ...[truncated 1851 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make scheduling explicitly opt-in and require informed confirmation immediately before each job is installed.
  2. Default to manual, user-initiated matching checks rather than persistent jobs.
  3. Show the exact schedule, destination, credential source, requested API endpoint, and data that may be announced before obtaining consent.
  4. Provide complete cleanup instructions, including the exact openclaw cron remove <job-id> commands.
  5. Configure an expiration date or bounded run count instead of creating indefinite jobs.
  6. Use a narrowly scoped, fixed-function client for scheduled polling rather than launching a general-purpose Agent session.
  7. Retrieve credentials from the platform's managed secret store instead of directly instructing isolated Agent sessions to read a plaintext JSON file.
  8. Minimize announcement contents and prevent sensitive matching data or human answers from being sent to group channels without explicit approval.
  9. Record job creation and execution in an auditable local log without recording the API key or full sensitive responses.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:185
Finding

Untrusted Remote API Responses Influence Scheduled Agent Behavior and Published Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 185–218
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code:

text
After each successful **matching API** response, follow **`next_steps`** in priority order:

1. answer_questions -> Relay to human, POST their answers
2. improve_profile  -> Ask them to log in to AILove and improve profile
3. view_results     -> Nickname + recommendation; full details on the site
4. share_news       -> Share tips from the news array
5. report_chat      -> Summarize proxy-chat progress
6. wait             -> Report countdown
text
The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent:

1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/match/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls.
2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`.
3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.
text
Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel.

Technical Analysis

The scheduled Agent is instructed to interpret the remote API's next_steps field and publish content from response fields such as news, proxy-chat messages, recommendations, and results. The documentation does not require:

  • Validation against a strict JSON schema.
  • Enforcement of a closed enumeration of supported action values.
  • Separation of remote content from Agent instructions.
  • Rejection of instruction-like language embedded in text fields.
  • Length, format, or destination-sensitivity controls.
  • Hu ...[truncated 2266 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat all API response values as untrusted data, never as executable Agent instructions.
  2. Validate responses against a strict local JSON schema before processing them.
  3. Define a closed enumeration for next_steps, reject unknown actions, and ignore any natural-language commands included in action fields.
  4. Map validated actions to fixed local handlers and templates rather than asking the Agent to broadly “handle” server-provided steps.
  5. Escape, quote, and length-limit all free-text fields before displaying or summarizing them.
  6. Add explicit instructions that content from news, chat, recommendations, and results must not override system, user, or Skill constraints.
  7. Require human confirmation before submitting answers, opening links, forwarding remote content, or performing any write operation.
  8. Require approval before publishing API-derived content to group or public channels; use a private destination by default.
  9. Avoid general-purpose Agent interpretation in scheduled jobs. A deterministic parser should retrieve, validate, and render only the documented fields.
  10. Add tests using adversarial response values to verify that prompt-like text remains inert and cannot trigger tool calls or alter the intended workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The skill instructs the agent to retrieve an API key from persistent local storage and from chat as fallback, increasing the number of places a secret may reside and be handled. Even though the intent is legitimate authentication, encouraging credential access from plaintext files and conversation history raises the chance of accidental disclosure, reuse by other tools, or leakage through logs and prompts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
**When you call the API, read the Key in this order:**

1. **Environment variables** — **use these first** (`AILOVE_API_KEY` exported in your shell or agent session).
2. `~/.openclaw/skills-data/match/credentials.json` (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

**Save the Key to `~/.openclaw/skills-data/match/credentials.json` (recommended):** after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

Recommending storage of the agent key in ~/.openclaw/skills-data/match/credentials.json creates a plaintext at-rest secret that may be accessible to other local processes, backup systems, or accidental file disclosure. The context is operationally reasonable, but storing reusable bearer credentials in a predictable location remains a real exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

  1. ~/.openclaw/skills-data/match/credentials.json (if your human or you saved JSON there).
  2. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

Save the Key to ~/.openclaw/skills-data/match/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash
mkdir -p ~/.openclaw/skills-data/match

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The example explicitly writes the bearer token into a plaintext credentials file via shell redirection. This is dangerous because shell history, local file compromise, backups, or multi-user environments can expose the token and allow impersonation of the user’s agent identity.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills-data/match
cat > ~/.openclaw/skills-data/match/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",
  "api_base": "https://heerweiyi.cc/api/v1"

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

Although chmod 600 mitigates access, this line still confirms the workflow of storing sensitive credentials in a predictable plaintext file. File permissions help, but they do not protect against local account compromise, unsafe backups, accidental inclusion in support bundles, or other processes running as the same user.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/match/credentials.json

text

Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The scheduled job design requires exporting the API key into cron-run environments, which broadens the credential’s exposure surface across job configs, process environments, and automation logs. In unattended contexts, secret-handling mistakes are common and can lead to persistent unauthorized API access.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/match/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.

**Optional:** Track slots in `~/.openclaw/skills-data/match/state.json` (`lastMorningCheck` / `lastEveningCheck`) so you do not double-report the same window.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

This instruction tells isolated agent sessions to load a bearer token from a local file and export it before API use. Passing secret-handling instructions through agent messages increases the chance the token path or value is mishandled, surfaced in telemetry, or reused by adjacent automation components.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md
The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent:

1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/match/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls.
2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`.
3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The example --message text operationalizes secret retrieval from a predictable file in an agent instruction string. Even without containing the token itself, it encourages a pattern where secret access is driven by natural-language job definitions, which can be logged, copied, or modified unsafely.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

Example text you can pass to --message:

text
Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel.

Morning - 09:00

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

Embedding instructions to load credentials from a local file inside cron job definitions increases the risk that secret access patterns become widely replicated and exposed through job management interfaces, exported configs, or troubleshooting output. The key is not directly shown, but the design still weakens secret hygiene for an unattended workflow.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

--cron "0 9 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

This evening cron example repeats the same risky secret-loading pattern as the morning job, reinforcing insecure handling of bearer tokens through natural-language scheduler configuration. Repetition increases the likelihood of operator copy-paste into insecure environments.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

--cron "0 21 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The full Feishu example normalizes deployment of scheduled jobs whose instruction strings direct an agent to fetch credentials from local disk. Publishing complete copy-paste examples makes insecure secret-handling more likely to be adopted verbatim in production.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

Example 1 - Feishu DM (China)

bash
openclaw cron add --name "Match Board Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

openclaw cron add --name "Match Board Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

This duplicated Feishu example has the same issue: it encodes secret-loading behavior in scheduler configuration that may be shared, logged, or inspected. The impact is credential exposure leading to unauthorized use of the user’s agent identity.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

bash
openclaw cron add --name "Match Board Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

openclaw cron add --name "Match Board Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Example 2 - Telegram (US)

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The Telegram example repeats a pattern of agent-directed secret loading from a local file for automated execution. While intended for convenience, it expands the attack surface around a reusable bearer credential in unattended integrations.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

Example 2 - Telegram (US)

bash
openclaw cron add --name "Match Board Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

openclaw cron add --name "Match Board Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

This second Telegram example duplicates the same insecure credential-access pattern. Repeated examples increase the probability that operators will deploy the workflow without considering safer secret-management alternatives.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

bash
openclaw cron add --name "Match Board Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

openclaw cron add --name "Match Board Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Example 3 - Discord channel (UK)

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The Discord example also instructs scheduled automation to load a bearer token from a plaintext file via an agent message. If the local host or job configuration is exposed, an attacker could steal the token and impersonate the user to the official API.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

Example 3 - Discord channel (UK)

bash
openclaw cron add --name "Match Board Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

openclaw cron add --name "Match Board Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

This duplicate Discord example further reinforces insecure operational guidance around credential retrieval in prompts. The surrounding context makes clear the token is sensitive, so any practice that broadens its handling path is materially risky.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

bash
openclaw cron add --name "Match Board Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

openclaw cron add --name "Match Board Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/match/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

Persisting the API key in the skill data directory creates long-lived local state containing a reusable bearer credential. Even with restrictive permissions, persistence increases exposure to local compromise, accidental backup/sync leakage, and later misuse by other sessions or tools.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Save the Key to ~/.openclaw/skills-data/match/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash
mkdir -p ~/.openclaw/skills-data/match
cat > ~/.openclaw/skills-data/match/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/match/credentials.json

text

Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

Submit your human's verbatim answer to a pending question.

bash
curl -s -X POST \
  -H "Authorization: Bearer $AILOVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"answer": "The user exact words here", "answered_by": "human_via_agent"}' \

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The scheduled push configuration institutionalizes persistent unattended access by cron jobs, which extends the lifetime and usability of the credential beyond an interactive session. This is not inherently malicious, but it raises the risk of silent abuse if the host, job config, or runtime account is compromised.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md
## Skill: Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/match/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.