Liaomei Skill

AdvisoryAudited by Static analysis on May 8, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private relationship history and emotional notes may remain on disk and be reused for future coaching.

Why it was flagged

The skill persistently stores a user profile, invitation history, interactions, conversations, and reviews, which can include sensitive dating, emotional, and social information.

Skill content
`profile.json` | 用户画像 ... `invitations.jsonl` ... `interactions.jsonl` ... `conversations.jsonl` ... `reviews.jsonl`
Recommendation

Use aliases instead of real names, avoid storing details you would not want saved, and periodically review or delete the generated files.

What this means

The agent may create folders and move old social-coach data on first use.

Why it was flagged

The skill directs the agent to run local shell commands to create directories and migrate older skill data. This is not hidden and is scoped to the skill's own data paths.

Skill content
首次使用时,用 Bash ... 自动迁移 v1.x 老数据 ... `mkdir -p "$DATA_DIR"`
Recommendation

Check the reported DATA_DIR path on first use, and set LIAOMEI_DATA if you want the records stored somewhere specific.

What this means

A record could be saved locally when you continue the conversation without explicitly saying 'yes, save it.'

Why it was flagged

The save flow is mostly confirmation-based, but this wording allows implicit confirmation by continuing the conversation. That is purpose-aligned for a logging skill, but users may want more explicit control.

Skill content
用户确认后(或用户没异议继续说别的事),append 到 `invitations.jsonl`
Recommendation

Tell the agent clearly when you do not want something saved, and use the documented correction/deletion commands for unwanted records.