Hinge Dating Profile Optimizer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:20 PM UTC
• Version: 0.1.0

Overview

This is a markdown-only Hinge profile coaching skill that requests sensitive dating-profile details and photos for its stated purpose, with no hidden code execution or exfiltration behavior found.

Before installing, be comfortable with a coaching workflow that may ask for dating-profile screenshots, photos, preferences, and personal stories. Share only what is needed, avoid exact addresses, workplace badges, documents, children, non-consenting third parties, and anything you would not want reflected in a public dating profile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

This is the full process: honest audit, proper interview, photo strategy, copy that sounds like you, settings cleanup, and help putting it live.

It's a small time cost to meet your life partner. Or your weekend 9/10 hookup. We don't judge.

---

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- "Give me travel tips for"
- "You should leave a comment if"

### Personality Reveal Prompts
- "My simple pleasures"
- "The dorkiest thing about me is"
- "My biggest date fail"

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- "Give me travel tips for"
- "You should leave a comment if"

### Personality Reveal Prompts
- "My simple pleasures"
- "The dorkiest thing about me is"
- "My biggest date fail"

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- "My simple pleasures"
- "The dorkiest thing about me is"
- "My biggest date fail"
- "Don't judge me"
- "Believe it or not"

### Interactive Prompts

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- "My simple pleasures"
- "The dorkiest thing about me is"
- "My biggest date fail"
- "Don't judge me"
- "Believe it or not"

### Interactive Prompts

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- "My simple pleasures"
- "The dorkiest thing about me is"
- "My biggest date fail"
- "Don't judge me"
- "Believe it or not"

### Interactive Prompts

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- "My simple pleasures"
- "The dorkiest thing about me is"
- "My biggest date fail"
- "Don't judge me"
- "Believe it or not"

### Interactive Prompts

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README suggests activating the skill by saying "Help me optimize my Hinge profile," but it does not define whether that exact phrase is required, what close variants are supported, or any exclusion conditions. Because the trigger guidance is informal and lacks boundaries or negative examples, users may invoke the skill unintentionally or be unsure when it should activate.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description is very broad and can be triggered by many common requests about dating, photos, writing, or profile improvement without tight boundaries. Over-broad invocation increases the chance the skill is activated in contexts where users did not explicitly intend to share sensitive relationship, identity, or image data, creating unnecessary privacy and consent risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill solicits highly personal dating-profile details, target preferences, frustrations, relationship patterns, and potentially sensitive life information without first warning the user about privacy implications or encouraging data minimization. In context, this is more dangerous because dating-profile coaching naturally elicits intimate personal, demographic, and behavioral data that could expose sexual preferences, location habits, social graph details, or emotional vulnerabilities if overshared.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Requesting 'all available photos' without guardrails encourages oversharing of sensitive personal images, including images with metadata, children, friends, homes, workplaces, travel patterns, or other identifying details not needed for profile optimization. The dating-profile context amplifies the risk because images can reveal identity, precise lifestyle markers, and third-party information, and users may feel pressured to submit their full personal photo library for evaluation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The discovery flow explicitly solicits sensitive relationship and family information such as who the user is closest to, family setup, and unusual relationships, but only offers a generic 'skip anything you want' framing rather than a clear privacy warning, purpose limitation, or guidance not to share identifying details. In a dating-profile optimization context, users may over-disclose intimate or identifying information that could later be incorporated into profile copy or notes, increasing privacy and stalking risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The dealbreaker section lists sensitive categories such as religion, politics, ethnicity, children, and substance use, then frames them primarily as optimization levers to avoid over-filtering. Without a fairness or privacy warning, this can encourage users to operationalize sensitive traits as exclusion criteria in ways that reinforce discriminatory selection practices or expose personal preferences around protected characteristics.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guidance recommends hiding or showing sensitive attributes like politics and religion as an optimization tactic without warning about privacy, discrimination, or downstream fairness implications. In a dating-profile coaching skill, this can normalize strategic concealment of sensitive traits and encourage users to make filtering decisions based on protected or highly personal characteristics without informed consent considerations.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill gives prescriptive, binary gender-based strategy advice that can steer users into stereotyped or exclusionary recommendations without consent or accommodation for non-binary identities. In a dating-profile optimization context, that can cause harmful mispersonalization, alienate users, and produce biased outputs that affect intimate social interactions and emotional wellbeing.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The document explicitly praises "British humor" as desirable and several examples rely on UK-specific references such as pub quiz, Saturday Kitchen, and Jazz Cafe in London. Because the file does not indicate that the skill is limited to UK users or offer locale adaptation, this reads as a natural-language locale preference that may not fit all users.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This markdown file describes staying with the user during profile implementation and changing profile photos, prompts, settings, and captions, but it does not include any warning that these actions affect publicly shared personal data and may have privacy or reputational consequences. Under the markdown-specific warning rule, user-facing descriptions should disclose behaviors that could affect user data or privacy when such actions are encouraged.

Static analysis

No suspicious patterns detected.