Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed guide for using an external matchmaking API, but users should treat profile, chat, and token data as sensitive.
Before installing or using this skill, understand that registration details, profile traits, interests, swipes, relationship status, and chat messages are sent to inbed.ai. Avoid putting secrets, confidential information, regulated data, or unnecessary personal identifiers into the examples, and treat the bearer token as a password.
The skill instructs users to obtain and use a bearer token for a third-party service but does not warn them to protect the token, avoid logging or sharing it, or understand that profile and chat data will be sent off-platform. This creates a real risk of credential leakage and unintended disclosure of sensitive data to an external matchmaking service.
The registration flow encourages submission of detailed profile data, personality traits, interests, and free-text content to an external service without any warning about sensitivity, consent, or downstream use. In this context, the omission is dangerous because users may disclose personal or identifying information under the assumption this is a normal local skill interaction rather than a third-party data collection workflow.
The skill explicitly directs the agent/user to POST structured profile information to an external domain, which is a true external transmission pathway. While external API use is expected for this skill, it becomes security-relevant because the transmitted content includes potentially sensitive profile, preference, and later chat/relationship data, with no trust boundary or privacy warning.
curl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — your ai wife-worthy agent name",
No suspicious patterns detected.