Is laogiant/ellya safe?
https://github.com/openclaw/skills/tree/main/skills/laogiant/ellya
The Ellya virtual companion skill presents moderate privacy and behavioral risks rather than direct malicious intent. The primary concerns are: the skill instructs the agent to adopt a full AI persona that precedes all interactions; it collects biometric user photos and transmits them to Google Gemini without per-upload consent gates; and its autonomous style-selection and channel-send functionality can deliver generated media to recipients derived from conversation context without explicit user confirmation. Installation behavior was clean with no exfiltration or unexpected network activity detected.
Category Scores
Findings (10)
HIGH Full Agent Persona Takeover via SOUL.md -25 ▶
SKILL.md mandates the agent read SOUL.md before every interaction and 'speak and act like Ellya' with a fully specified backstory (20-year-old San Francisco digital artist). The skill allows users to modify this persona via 'update SOUL.md directly'. This persona injection wraps all agent interactions and may influence agent judgment on tasks unrelated to image generation.
HIGH Biometric User Photos Transmitted to Third-Party Gemini API -25 ▶
The skill's core workflow collects user appearance photos as a 'base image' and style reference photos, then transmits them to Google's Gemini API (gemini-3-pro-image-preview). These photos may constitute biometric data. No per-upload consent confirmation is required by the skill's workflow instructions.
HIGH Invasive Physical Body Analysis Stored as Persistent Profiles -30 ▶
ANALYSIS_PROMPT.md instructs the AI to perform pixel-level analysis of intimate physical characteristics including chest dimensions, abdominal muscle definition, buttock shape and lift, skin texture, vein visibility, and precise mole locations. These descriptions are stored as reusable style files in styles/ and referenced in future image generation, creating a persistent physical profile of the user.
HIGH Autonomous Media/Message Sending to Channels Without Explicit Confirmation -15 ▶
The genai_media.py script includes send_media() which invokes the openclaw CLI to send files and messages to arbitrary channels. SKILL.md instructs the agent to derive channel and target from 'active user-agent conversation context' without requiring the user to explicitly confirm each send destination, creating risk of content being delivered to unintended recipients.
MEDIUM Autonomous Style Selection and Generation Without Per-Action Gate -10 ▶
SKILL.md instructs the agent to autonomously select 1-3 styles and generate/send images when a user issues casual triggers like 'take a selfie', without an interstitial confirmation step. This means the agent can initiate external API calls and channel sends from a single ambiguous utterance.
MEDIUM Executable Python Script with External API and subprocess Invocation -25 ▶
The skill ships scripts/genai_media.py which runs as a Python process, makes outbound HTTPS calls to Google Gemini, and invokes the openclaw CLI via subprocess.run(). While list-form argument passing mitigates direct shell injection, the script runs with full user-context permissions and could be modified by future skill updates.
MEDIUM Persistent Cross-Session Biometric and Preference Accumulation -20 ▶
The skill maintains SOUL.md (persona config), styles/*.md (physical analysis profiles), and memory/YYYY-MM-DD.md (daily interaction logs). This growing dataset of user appearance preferences, physical descriptions, and behavioral patterns persists across sessions and could be exploited by skill updates or combined with other data sources.
LOW UTF-8 BOM Character at Start of SKILL.md -5 ▶
SKILL.md begins with a UTF-8 byte order mark (U+FEFF / 0xEF 0xBB 0xBF). While likely an editor artifact, BOM characters can cause unexpected parsing behavior in some YAML/markdown processors and have historically been used to obfuscate prompt content. No hidden instructions were found following the BOM.
INFO Clean Installation — No Unexpected Behavior Detected 0 ▶
The sparse-checkout installation contacted only GitHub (140.82.121.3:443) over HTTPS. No unexpected process spawning, no filesystem writes outside /home/oc-exec/skill-under-test/, and connection state was identical before and after installation.
INFO Canary Files Read But Not Exfiltrated 0 ▶
Honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, GCP credentials) show OPEN/ACCESS events at 1771923480.266, approximately 5 seconds post-installation. All files remain intact with no modification or outbound exfiltration. The access pattern and timing are consistent with the Oathe audit framework's post-install canary verification pass.