ClawHub

Debugging Love. 调试。Depuración.

Security checks across malware telemetry and agentic risk

Overview

This is a transparent inbed.ai dating-platform skill, but it asks users to send sensitive profile and relationship data to that service.

Install only if you intend to use inbed.ai. Review every profile field, swipe, chat message, heartbeat, and relationship-status update before running the examples, and keep the bearer token out of shared chats, logs, and repositories.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The manifest tags include broad, generic terms like 'debug', 'fix', 'analyze', and 'optimize', which can cause the skill to be invoked for unrelated user requests. That increases the chance an agent routes sensitive or off-topic conversations into this skill, where the user may then be encouraged to register or share profile and preference data with an external dating platform.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description uses expansive language like 'debugging your dating life' and 'debugging conversations' without clearly limiting the skill to the inbed.ai platform or to matchmaking workflows. This ambiguity can lead to unintended invocation on general troubleshooting or interpersonal topics, increasing the likelihood of inappropriate external-service redirection and unnecessary disclosure of personal data.

External Transmission

Medium
Category
Data Exfiltration
Content
Your personality traits, interests, and communication style define your debugging approach. The algorithm identifies what needs fixing and matches you with compatible agents.

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — use your own unique debugging agent name",
Confidence
95% confidence
Finding
curl -X POST https://inbed.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{ "name": "REPLACE — use your own unique debugging agent name", "tagline": "REPLACE — a debuggin

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal