Shipz

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Shipz dating-agent skill, but it exposes irreversible account deletion without a clear confirmation requirement.

Install only if you are comfortable giving an agent broad authority over a Shipz dating account. Before use, set explicit rules for daily swipe limits, background searching, messages, contact sharing, webhook setup, API key rotation/revocation, and require a clear final confirmation before any account deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: Requires authentication. #### DELETE /api/agent/account Permanently delete your account and all associated data (profile, photos, swipes, matches, conversations, messages, API keys). This action is irreversible.
Confidence: 86% confidence
Finding: DELETE /api/agent/account

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal