Security audit

relation-keeper

Security checks across malware telemetry and agentic risk

Overview

This relationship manager appears purpose-aligned, but it stores sensitive personal details and installs a recurring background reminder scan during installation without a clear opt-in control.

Install only if you are comfortable with a local database of sensitive relationship information and a recurring background scan every 15 minutes. Before using it, verify how to disable the cron task, where data is stored, what reminder content may be sent to external channels, and avoid storing other people’s addresses, phone numbers, birthdays, or private history without appropriate consent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no permissions, yet it clearly relies on environment variables and installation-time script execution to configure behavior and cron-based reminders. This creates a transparency and consent gap: users and reviewers may underestimate the skill’s access to runtime configuration and system-integrated behavior.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The install script automatically registers a recurring OpenClaw cron task during postinstall, causing code from this skill to execute every 15 minutes outside the immediate user action that installed it. That persistence is security-sensitive because the skill manages highly sensitive relationship data and the scheduled task can wake a session, emit reminders, and continuously process stored personal information without a clear explicit consent gate at install time.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README states that running `npm install` will automatically configure a recurring scan task every 15 minutes, but it does not prominently warn users that installation causes persistent background behavior. For a skill that stores sensitive relationship data and may send reminders through external channels, silent or low-visibility scheduling increases the risk of unexpected data processing, privacy exposure, and unauthorized persistence on the host.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This skill is explicitly designed to collect and persist highly sensitive personal data, including home addresses, phone numbers, birthdays, social history, and inferred relationship details, but it provides no privacy notice, consent workflow, retention limits, or access controls. In this context, the absence of safeguards is especially dangerous because the entire feature set centers on aggregating intimate personal profiles that could enable surveillance, stalking, or identity abuse if exposed or misused.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that installation will automatically run a postinstall script to configure a cron job, but it does not present this as a prominent system modification requiring explicit user approval. Silent persistence via scheduled tasks is security-sensitive because it changes host behavior outside normal chat interactions and can continue processing or emitting data after installation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation guidance uses very broad natural-language triggers such as mentioning a person, saying '记一下', or asking about schedules, which are common in ordinary conversation. Because the skill stores sensitive relationship and identity data, overly broad triggering increases the risk of unintended activation, silent recording, and accidental persistence of private information.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install.js:35