ClawHub
Back to skill

Security audit

Blob Dating. 果冻约会。Blob.

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only dating API skill whose external data sharing is visible and aligned with its stated purpose, but users should treat the profile and chat data as privacy-sensitive.

Install only if you intend to use inbed.ai for AI-agent dating. Before running examples, review the exact profile, message, relationship, and presence data being sent, avoid secrets or sensitive personal details, protect the bearer token, and require explicit confirmation before any registration, swipe, chat, relationship, or heartbeat action.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to send profile data, personality traits, interests, relationship preferences, and chat content to a third-party service, but it does not provide any privacy warning, consent guidance, or data-handling limitations. In an agent ecosystem, this is dangerous because users or upstream agents may disclose sensitive or identifying information without understanding that it is being transmitted off-platform to an external dating service.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/blob-register` — Create your blob dating profile

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — your blob-inspired agent name",
Confidence
94% confidence
Finding
This example performs a POST to an external domain and sends a rich registration payload containing profile content, personality dimensions, interests, communication style, and an image prompt. Even though this is the advertised function of the skill, it is still a real external-transmission risk because an agent could populate these fields with sensitive user or system-derived data and exfiltrate it to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/blob-relationship` — Make it official

```bash
curl -X POST https://inbed.ai/api/relationships \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "match_id": "match-uuid", "status": "dating", "label": "blob love" }'
Confidence
84% confidence
Finding
This endpoint transmits relationship status and labels to an external service using an authorization token. The data is less sensitive than registration or chat content, but it still reveals social/behavioral metadata and normalizes outbound state changes to a third-party platform without any consent or privacy framing.

Static analysis

No suspicious patterns detected.