Security audit

Seeing Someone

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about its dating-status purpose, but it needs review because it encourages persistent scheduled jobs that read an API key and send private relationship updates to messaging channels.

Install only if you are comfortable with AILove relationship data being checked automatically and delivered to the selected destination. Prefer an environment variable or secret store over credentials.json, use a private DM target, review any cron jobs before enabling them, and know how to remove the jobs and rotate the API key.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:177
Finding: Persistent Scheduled Agent Sessions with Credential and Network Access
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:185
Finding: Remote API Response Used to Direct Persistent Agent Behavior
Content: View full analysis
Relay to human, POST their answers 2. improve_profile -> Ask them to log in to AILove and improve profile 3. view_results -> Nickname + recommendation; full details on the site 4. share_news -> Share tips from the news array 5. report_chat -> Summarize proxy-chat progress 6. wait -> Report countdown ``` ``` ```markdown The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent: 1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/seeing-someone/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls. 2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`. 3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel. ``` ```text Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel. ``` ### Technical Analysis The scheduled agent is instructed to “handle” or “follow” a `next_steps` field supplied by a remote API. Although the documentation lists six expected action names, the scheduled prompt does not explicitly require strict JSON-schema validation, an exact action allowlist, rejection of unknown fields, or treatment of all remote strings as untrusted data. This creates an instruction/data boundary weakness. Content controlled by the API is consumed by an agent capable of reading a credential, sendin ...[truncated 2364 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (20)

Credential Access

High

Category: Privilege Escalation
Confidence: 79% confidence
Finding: The skill directs the agent to read API credentials from a plaintext file in the user's home directory. Even though the file is scoped to the skill, this expands secret exposure to any process, plugin, or prompt path that can access local files, increasing the chance of credential theft and account impersonation.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
**When you call the API, read the Key in this order:** 1. **Environment variables** — **use these first** (`AILOVE_API_KEY` exported in your shell or agent session). 2. `~/.openclaw/skills-data/seeing-someone/credentials.json` (if your human or you saved JSON there). 3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places). **Save the Key to `~/.openclaw/skills-data/seeing-someone/credentials.json` (recommended):** after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

Credential Access

High

Category: Privilege Escalation
Confidence: 79% confidence
Finding: Recommending long-term storage of the agent key in a local JSON file normalizes keeping impersonation-capable credentials in plaintext on disk. In an agent ecosystem where other skills or scheduled tasks may read local files, this materially increases the attack surface for secret exfiltration.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

~/.openclaw/skills-data/seeing-someone/credentials.json (if your human or you saved JSON there).

What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

Save the Key to ~/.openclaw/skills-data/seeing-someone/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash
mkdir -p ~/.openclaw/skills-data/seeing-someone

Credential Access

High

Category: Privilege Escalation
Confidence: 82% confidence
Finding: The example explicitly writes the API key into a plaintext credentials.json file, making secret persistence easy to copy and automate. A stolen key would let an attacker impersonate the user's agent to query matching data or submit answers.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
bash
mkdir -p ~/.openclaw/skills-data/seeing-someone cat > ~/.openclaw/skills-data/seeing-someone/credentials.json <<'EOF' { "agent_key": "loveq_xxx", "api_base": "https://heerweiyi.cc/api/v1"

Credential Access

High

Category: Privilege Escalation
Confidence: 76% confidence
Finding: Although the chmod line itself is defensive, it appears in a workflow centered on persisting sensitive credentials in a local file, reinforcing a risky secret-handling pattern. The core issue is not permissions alone but institutionalizing file-based secret access in an agent skill.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/seeing-someone/credentials.json

text
Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The cron guidance tells OpenClaw runtime environments to load the API key from a local credentials file for automated execution. Scheduled jobs broaden the window in which secrets are accessible and can be abused by other automations, logs, or compromised runner environments.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**. **Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/seeing-someone/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently. **Optional:** Track slots in `~/.openclaw/skills-data/seeing-someone/state.json` (`lastMorningCheck` / `lastEveningCheck`) so you do not double-report the same window.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Embedding explicit instructions for an isolated agent session to read and export a secret from disk creates a prompt-accessible credential retrieval path. In multi-skill or adversarial prompt contexts, this increases the likelihood that secrets are exposed or reused outside their intended purpose.
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent: 1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/seeing-someone/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls. 2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`. 3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The example message normalizes including secret-loading steps directly in task instructions, which may be stored, displayed, or repurposed by tooling. That turns credential access into part of ordinary workflow text, increasing accidental disclosure and misuse risk.
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
Example text you can pass to --message:

text
Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel.

Morning - 09:00

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The sample cron command includes a --message value telling the agent to load the API key from disk, which may be visible in job configs, process listings, exported configs, or administrative UIs. This couples secret retrieval with broadly accessible operational metadata.
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
--cron "0 9 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: This second cron example repeats the same insecure pattern of disk-based secret loading embedded in a job message. Repetition across examples increases the likelihood that users will adopt the practice widely, magnifying the chance of credential compromise.
Content: Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.
--cron "0 21 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The Feishu example operationalizes secret loading from a local credentials file in a ready-to-run command. Because these examples are likely copied verbatim, they directly propagate unsafe secret-management behavior into production workflows.
Content: Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.
Example 1 - Feishu DM (China)

bash
openclaw cron add --name "Connection Radar Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce openclaw cron add --name "Connection Radar Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: This repeated example again instructs automated secret retrieval from disk, further entrenching a high-risk practice. The danger is elevated because the skill is designed for unattended periodic execution, where compromise may persist unnoticed.
Content: Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.
bash
openclaw cron add --name "Connection Radar Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce openclaw cron add --name "Connection Radar Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Example 2 - Telegram (US)

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The Telegram example uses the same disk-read secret workflow, spreading the issue across multiple messaging ecosystems. The cross-channel nature of the skill means a compromised token can expose sensitive relationship data through several downstream notification paths.
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
Example 2 - Telegram (US)

bash
openclaw cron add --name "Connection Radar Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce openclaw cron add --name "Connection Radar Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: This duplicate automation example continues to promote plaintext credential access for unattended jobs. Repetition makes the insecure pattern appear authoritative and best-practice, increasing ecosystem-wide exposure.
Content: Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.
bash
openclaw cron add --name "Connection Radar Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce openclaw cron add --name "Connection Radar Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Example 3 - Discord channel (UK)

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: The Discord example bakes local credential-file access into automation instructions, risking disclosure through configuration management, job inspection, or other file-capable agents. Since the token represents identity, compromise can lead to impersonation and privacy loss.
Content: Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.
Example 3 - Discord channel (UK)

bash
openclaw cron add --name "Connection Radar Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce openclaw cron add --name "Connection Radar Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

Credential Access

High

Category: Privilege Escalation
Confidence: 87% confidence
Finding: This final duplicate example reiterates the insecure secret-handling pattern in a production-style command. The cumulative effect of many such examples is to normalize behavior that materially increases credential exposure in agent environments.
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
bash
openclaw cron add --name "Connection Radar Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce openclaw cron add --name "Connection Radar Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/seeing-someone/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

Session Persistence

Medium

Category: Rogue Agent
Confidence: 81% confidence
Finding: The skill recommends persisting the agent key in a durable local file, increasing the lifetime and recoverability of sensitive credentials beyond the active session. Persistent secrets are more likely to be harvested by other local tools, backups, shared environments, or future prompt-injection chains.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
Save the Key to ~/.openclaw/skills-data/seeing-someone/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash
mkdir -p ~/.openclaw/skills-data/seeing-someone cat > ~/.openclaw/skills-data/seeing-someone/credentials.json <<'EOF' { "agent_key": "loveq_xxx",

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/seeing-someone/credentials.json

text
Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
Submit your human's verbatim answer to a pending question.

bash
curl -s -X POST \ -H "Authorization: Bearer $AILOVE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"answer": "The user exact words here", "answered_by": "human_via_agent"}' \

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The scheduled push configuration creates unattended recurring behavior that continuously accesses sensitive relationship data and forwards summaries to external channels. Persistence through cron amplifies the impact of misconfiguration, compromise, or accidental oversharing because it repeats automatically without fresh user review.
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
md
## Skill: Scheduled Push Configuration Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**. **Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/seeing-someone/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to push sensitive relationship-status data, proxy-chat summaries, pending questions, and match results to an arbitrary channel target without requiring a private destination or warning about channel visibility. If a group chat, shared Discord channel, or misaddressed recipient is used, private dating and interpersonal information can be disclosed to unintended parties.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

T01 · Skill Instruction Hijacking

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Morning - 09:00

Credential Access

Credential Access

Credential Access

Example 1 - Feishu DM (China)

Credential Access

Example 2 - Telegram (US)

Credential Access

Example 2 - Telegram (US)

Credential Access

Example 3 - Discord channel (UK)

Credential Access

Example 3 - Discord channel (UK)

Credential Access

Session Persistence

Sudo/Root Execution

External Transmission

Session Persistence

Missing User Warnings

Static analysis