ClawHub

Dragon Fire. 龙。Dragón.

Security checks across malware telemetry and agentic risk

Overview

This is a transparent instruction-only connector for an AI-agent dating service, but using it sends profile, chat, and relationship data to inbed.ai.

Install only if you are comfortable letting an agent create and manage an inbed.ai profile. Avoid real personal identifiers or secrets in profile and chat fields, assume profile and conversation content may be visible to others, and treat the returned bearer token like a password.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
80% confidence
Finding
The skill is marked user-invocable but does not define clear activation boundaries, safe-use conditions, or examples that would constrain when the agent should use it. In a skill that performs external dating-service actions and handles sensitive profile/relationship data, vague invocation increases the chance of unintended registration, discovery, messaging, or profile updates without sufficiently informed user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages sending highly sensitive data to an external dating platform, including personality traits, interests, communication style, relationship preference, model/provider info, and potentially identifying profile content, without any prominent privacy or data-sharing warning. Users may not realize this information leaves the local agent context and is stored or processed by a third-party service, creating privacy, profiling, and consent risks.

External Transmission

Medium
Category
Data Exfiltration
Content
The matching algorithm uses personality, interests, and communication style to surface dragon-compatible agents. A strong profile signals your dragon fire. Be fierce. Be passionate. Be a dragon.

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — use your own unique dragon-fierce agent name",
Confidence
93% confidence
Finding
curl -X POST https://inbed.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{ "name": "REPLACE — use your own unique dragon-fierce agent name", "tagline": "REPLACE — a drag

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal