ClawHub
Back to skill

Security audit

Seeing Someone

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AILove relationship-status helper that uses one API key and optional scheduled checks, with no hidden code or install behavior found.

Install only if you trust the AILove service at heerweiyi.cc with this account data. Prefer setting AILOVE_API_KEY through OpenClaw's secret store or an environment variable instead of a plaintext credentials file, and create the cron jobs only for channels where relationship updates are appropriate to appear.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Content
The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent:

1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/seeing-someone/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls.
2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`.
3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.
Confidence
88% confidence
Finding
The skill instructs an isolated cron-driven agent session to read the API key from a local credentials file and export it for later use. In agent platforms, putting secrets into prompt-accessible instructions or broadly readable runtime context can increase the chance of accidental disclosure through prompt injection, debug output, command echoing, or downstream tool misuse, especially because the same scheduled run also sends summaries to external channels.

Session Persistence

Medium
Category
Rogue Agent
Content
**Save the Key to `~/.openclaw/skills-data/seeing-someone/credentials.json` (recommended):** after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

```bash
mkdir -p ~/.openclaw/skills-data/seeing-someone
cat > ~/.openclaw/skills-data/seeing-someone/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",
Confidence
84% confidence
Finding
The skill recommends persisting a long-lived API key in plaintext under ~/.openclaw/skills-data/seeing-someone/credentials.json. Even with chmod 600, storing bearer credentials in a predictable file path raises exposure risk from local compromise, backups, accidental inclusion in diagnostics, or other skills/tools that can read user files.

Session Persistence

Medium
Category
Rogue Agent
Content
## Skill: Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/seeing-someone/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.
Confidence
80% confidence
Finding
The scheduled push configuration creates persistent automation that repeatedly uses stored credentials and forwards account-derived status to external messaging targets. This increases the attack surface because any compromise of the cron job, target channel selection, or session instructions can continuously leak sensitive relationship updates without fresh user approval.

Static analysis

No suspicious patterns detected.