ClawHub
Back to skill

Security audit

Zhaoduixiang

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill is coherent with its matchmaking update purpose, but it handles a sensitive service key and can schedule relationship updates to a chosen channel.

Install only if you trust heerweiyi.cc with this relationship workflow. Prefer storing AILOVE_API_KEY in an environment variable or secret store, verify the destination channel before enabling cron, and rotate or revoke the key if the channel or agent environment changes.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Content
The **`--message`** string is the instruction for the **isolated** agent session when cron fires. It should make the agent:

1. **Load `AILOVE_API_KEY`** from **`~/.openclaw/skills-data/zhaoduixiang/credentials.json`** — read the `agent_key` field and export it as `AILOVE_API_KEY` before making API calls.
2. **Call `GET https://heerweiyi.cc/api/v1/agent/matching`** with `Authorization: Bearer $AILOVE_API_KEY`.
3. **Handle `next_steps`** from the JSON response in priority order, then summarize for the human on the channel.
Confidence
82% confidence
Finding
The scheduled `--message` explicitly instructs an isolated agent session to read `~/.openclaw/skills-data/zhaoduixiang/credentials.json` and export the API key for later use. In agentic environments, prompting a downstream session to retrieve secrets from disk increases the risk that the key is exposed to the model context, mishandled, or reused beyond least privilege, especially if the session behavior or connected tools are not tightly constrained.

Session Persistence

Medium
Category
Rogue Agent
Content
**Save the Key to `~/.openclaw/skills-data/zhaoduixiang/credentials.json` (recommended):** after the human gives you the Key, save it to the skill's own data directory. Restrict permissions to owner-only.

```bash
mkdir -p ~/.openclaw/skills-data/zhaoduixiang
cat > ~/.openclaw/skills-data/zhaoduixiang/credentials.json <<'EOF'
{
  "agent_key": "loveq_xxx",
Confidence
88% confidence
Finding
The skill recommends persisting a long-lived API key in plaintext JSON under the user's home directory. Even with `chmod 600`, plaintext secret storage on disk increases exposure to local compromise, backups, accidental disclosure, or other tools/agents with filesystem access, making credential theft and account impersonation more likely.

Session Persistence

Medium
Category
Rogue Agent
Content
## Skill: Scheduled Push Configuration

Create **two** cron jobs (morning + evening) that check match status and push updates to your chosen channel. The scheduled agent turn should call the **matching API** as documented above (full URL + auth), then handle **`next_steps`**.

**Environment (required):** Export **`AILOVE_API_KEY`** wherever OpenClaw runs cron. Load it from `~/.openclaw/skills-data/zhaoduixiang/credentials.json` or your preferred secret store. If the key is missing when the job fires, the API call fails with 401 or fails silently.
Confidence
79% confidence
Finding
The cron configuration establishes persistent autonomous jobs that repeatedly use the API key and push relationship updates to external channels. This persistence raises the blast radius of any misconfiguration or channel mix-up: sensitive status, proxy-chat summaries, or question prompts could be sent to the wrong recipient on an ongoing basis without fresh human approval each time.

Static analysis

No suspicious patterns detected.