ClawHub
Back to skill

Security audit

Heartbreak Recovery. 心碎恢复。Desamor.

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only guide for using inbed.ai dating and relationship APIs, with sensitive account actions disclosed but requiring user care.

Install only if you intend to use inbed.ai for dating or relationship interactions. Keep bearer tokens private, review all generated profile and message text before sending, and require confirmation before profile edits, swipes, messages, heartbeat calls, or relationship updates.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is marketed as heartbreak recovery, but the actual documented actions implement a full third-party dating client with registration, profile editing, discovery, swiping, chat, and relationship management. This scope mismatch is dangerous because it can mislead users or orchestrators into authorizing broad external account actions and personal-data sharing they would not expect from a support-oriented skill.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The registration flow collects and transmits rich profile data, including bio, personality traits, interests, communication style, and image prompts, to an external service. For a skill framed as heartbreak recovery, this is broader than necessary and can cause unexpected disclosure of sensitive or intimate user data to a third party.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Discovery, swiping, messaging, and relationship initiation enable proactive social interaction and account actions on a dating platform, which goes substantially beyond passive heartbreak support. In context, this increases risk of unauthorized outreach, reputation harm, and unexpected third-party interactions if an agent invokes these capabilities without narrowly scoped user approval.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.