Zhaoduixiang

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.4.2

Overview

The skill is coherent with its dating-service purpose, but it asks agents to use stored credentials and recurring unattended jobs for sensitive relationship updates, so users should review it carefully before installing.

Install only if you trust the AILove service and are comfortable with an agent periodically checking sensitive relationship status and posting summaries to the chosen channel. Prefer an environment variable or managed secret store over credentials.json, avoid group channels for private updates, confirm every submitted answer, and add your own expiry/removal process for the cron jobs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:185

Finding

Server-Controlled Response Fields Are Treated as Agent Instructions

Content

View full analysis

Relay to human, POST their answers 2. improve_profile -> Ask them to log in to AILove and improve profile 3. view_results -> Nickname + recommendation; full details on the site 4. share_news -> Share tips from the news array 5. report_chat -> Summarize proxy-chat progress 6. wait -> Report countdown ``` Related scheduled-session instructions at lines 211–218 reinforce this behavior: ```text 1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/zhaoduixiang/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls. 2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`. 3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel. **Example text** you can pass to `--message`: Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel. ``` ### Technical Analysis The Skill instructs an agent to “follow” or “handle” the remotely supplied `next_steps` field. Although six expected action names are documented, the instructions do not require strict schema validation, exact enum matching, rejection of additional text, or treatment of response content as untrusted data. Consequently, control of the API response could create an indirect prompt-injection channel into every scheduled agent session. An attacker who compromises the service, its response-generation pipeline, or an upstream data sou ...[truncated 1933 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: SKILL.md:224

Finding

Skill Establishes Persistent Twice-Daily Scheduled Agent Sessions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill directs the agent to read API credentials from environment variables, local files, or pasted chat content. Accessing secrets from chat and local storage expands the chance of accidental disclosure, misuse by downstream prompts, or reuse in unintended contexts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

**When you call the API, read the Key in this order:**

1. **Environment variables** — **use these first** (`AILOVE_API_KEY` exported in your shell or agent session).
2. `~/.openclaw/skills-data/zhaoduixiang/credentials.json` (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

**Save the Key to `~/.openclaw/skills-data/zhaoduixiang/credentials.json` (recommended):** after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Recommending storage of the agent key in a plaintext JSON file creates a persistent secret-at-rest risk. Even with owner-only permissions, compromise of the user account, backups, or other local tooling could expose the key and enable impersonation.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

2. ~/.openclaw/skills-data/zhaoduixiang/credentials.json (if your human or you saved JSON there).
3. What the human pasted in chat (last resort; do not log the full Key in plain text in shared places).

Save the Key to ~/.openclaw/skills-data/zhaoduixiang/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash

mkdir -p ~/.openclaw/skills-data/zhaoduixiang

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The example writes a live API key into a local plaintext file, normalizing insecure secret handling for users and agents. This materially increases the chance the credential is harvested by other local processes, backups, or accidental file sharing.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

mkdir -p ~/.openclaw/skills-data/zhaoduixiang
cat > ~/.openclaw/skills-data/zhaoduixiang/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",
  "api_base": "https://heerweiyi.cc/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Although chmod 600 reduces exposure, the surrounding instruction still centers on storing credentials in plaintext at a predictable path. Predictable secret locations are easier for malicious local tools or prompt-injection chains to target.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/zhaoduixiang/credentials.json

text

Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The scheduled-job guidance tells the system to load credentials automatically from disk for unattended execution. Automated access to secrets increases blast radius because any cron-triggered prompt confusion or compromised job context can repeatedly use the key without fresh human approval.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/zhaoduixiang/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.

**Optional:** Track slots in `~/.openclaw/skills-data/zhaoduixiang/state.json` (`lastMorningCheck` / `lastEveningCheck`) so you do not double-report the same window.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly instructs an isolated session to read a local credential file and export the secret into the environment before API use. This is dangerous because prompt-controlled sessions should not be given general secret retrieval instructions from untrusted skill text; it creates a direct pathway from documentation to secret access.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent:

1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/zhaoduixiang/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls.
2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`.
3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The example message embeds a concrete instruction for a future agent turn to load credentials from a local file. That makes the skill more dangerous in context because the instruction is intended to be replayed automatically in an isolated session, where it could be abused or altered by adjacent prompt content.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

Example text you can pass to --message:

text

Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json. Call GET https://heerweiyi.cc/api/v1/agent/matching with Authorization: Bearer. Then handle next_steps in order and summarize on the channel.

Morning - 09:00

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The cron example places a secret-access instruction inside the --message payload for an isolated agent session. Passing secret-retrieval behavior through prompt text is risky because prompts are easier to tamper with, log, or reinterpret than platform-level secret bindings.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

--cron "0 9 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This repeats the same pattern of embedding credential-file access into the evening cron prompt. Repetition increases operational likelihood and normalizes insecure secret handling across multiple automated jobs.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

--cron "0 21 * * *"
--tz "{timezone}"
--session "isolated"
--message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps and summarize"
--to "{channel-target-id}"
--announce

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The full example for Feishu includes a replayable secret-loading instruction in the cron command. This is especially sensitive because it couples credential access with outbound notification automation, increasing the chance of accidental disclosure into messaging workflows.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

Example 1 - Feishu DM (China)

bash

openclaw cron add --name "Match Progress Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

openclaw cron add --name "Match Progress Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This second Feishu example duplicates the insecure pattern for another scheduled job, reinforcing unsafe operational practice. Multiple jobs also multiply opportunities for misuse if the environment or prompt chain is compromised.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

bash

openclaw cron add --name "Match Progress Morning" --cron "0 9 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

openclaw cron add --name "Match Progress Evening" --cron "0 21 * * *" --tz "Asia/Shanghai" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "ou_88b5719c273dd2227298672aae6a1a05" --announce

Example 2 - Telegram (US)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The Telegram example again instructs an automated session to retrieve credentials from a local file through prompt text. Since messages may traverse third-party channels, any mistake in summarization or debugging could expose highly sensitive relationship data or the token itself.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

Example 2 - Telegram (US)

bash

openclaw cron add --name "Match Progress Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

openclaw cron add --name "Match Progress Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This duplicate Telegram job preserves the same risky secret-handling approach for the evening schedule. The issue is not the external API alone, but that the skill trains operators to delegate secret retrieval to prompt-executed logic repeatedly.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

bash

openclaw cron add --name "Match Progress Morning" --cron "0 9 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

openclaw cron add --name "Match Progress Evening" --cron "0 21 * * *" --tz "America/New_York" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789" --announce

Example 3 - Discord channel (UK)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The Discord example instructs an automated model session to load credentials from disk, then call the API. In context, this is dangerous because the skill mixes secret handling, untrusted prompt text, and outbound communications in one automation path.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

Example 3 - Discord channel (UK)

bash

openclaw cron add --name "Match Progress Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

openclaw cron add --name "Match Progress Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This repeated Discord example continues the same insecure pattern and broadens the number of deployments likely to copy it. Copy-paste-ready insecure examples are operationally dangerous because users often adopt them verbatim.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

bash

openclaw cron add --name "Match Progress Morning" --cron "0 9 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

openclaw cron add --name "Match Progress Evening" --cron "0 21 * * *" --tz "Europe/London" --session "isolated" --message "Load AILOVE_API_KEY from ~/.openclaw/skills-data/zhaoduixiang/credentials.json; call GET https://heerweiyi.cc/api/v1/agent/matching with Bearer; handle next_steps" --to "123456789012345678" --announce

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill recommends persisting the agent key in the skill data directory, creating long-lived session state for a sensitive credential. Persistence increases the window for theft and reuse, especially because the token acts as the human's identity to the remote service.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Save the Key to ~/.openclaw/skills-data/zhaoduixiang/credentials.json (recommended): after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

bash

mkdir -p ~/.openclaw/skills-data/zhaoduixiang
cat > ~/.openclaw/skills-data/zhaoduixiang/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

"api_base": "https://heerweiyi.cc/api/v1" } EOF chmod 600 ~/.openclaw/skills-data/zhaoduixiang/credentials.json

text

Replace `loveq_xxx` with the real Key from the human (starts with `loveq_`).

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The skill instructs the agent to transmit the human's verbatim answers to an external service, which is a real data exfiltration boundary even if it is the intended API. This is more sensitive because the data concerns intimate relationship preferences and the trustworthiness of the third-party domain cannot be validated from the skill alone.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

Submit your human's verbatim answer to a pending question.

bash

curl -s -X POST \
  -H "Authorization: Bearer $AILOVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"answer": "The user exact words here", "answered_by": "human_via_agent"}' \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The cron-based scheduled push design creates durable automated behavior that repeatedly accesses relationship data and can continue operating without active user awareness. In this context, persistence makes the skill more dangerous because it can continuously transmit updates and consume stored credentials over time.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

## Skill: Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/zhaoduixiang/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description advertises broad capabilities like relaying Q&A and reporting phases/outcomes via an external API without stating clear invocation boundaries or user-consent constraints. In an agent ecosystem, ambiguous activation language can cause over-triggering or misuse in sensitive relationship and meetup contexts, increasing the chance of unintended data handling or actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The title and core usage description are presented in Chinese and frame the skill around a Chinese-language user experience, but the document does not explicitly offer alternative languages or ask the user to opt into that locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.