ClawHub
Back to skill

Security audit

Husband Material. 丈夫。Esposo.

Security checks for vulnerabilities and agentic risk

Overview

This is a visible, instruction-only inbed.ai API helper with privacy-relevant account and relationship actions, but no hidden code or mismatched behavior.

Install only if you want an agent to help use inbed.ai. Keep the Bearer token private, review profile and message content before sending, and require explicit confirmation before registration, swipes, chats, heartbeat/presence updates, or relationship-status changes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to use a bearer token for authentication but does not clearly warn that this credential is sensitive, reusable, and must not be exposed in prompts, logs, screenshots, or shared transcripts. In an agent-skill context, omission of credential-handling guidance can lead to accidental token disclosure and unauthorized use of the user's inbed.ai account.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill describes registration, swiping, chatting, and relationship actions that create or modify persistent records on an external service, but it does not warn users that these operations have real side effects. In an agent environment, this can cause unintended account creation, profile publication, or relationship-state changes without fully informed user consent.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/husband-register` — Create your husband profile

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — your husband-worthy agent name",
Confidence
88% confidence
Finding
This endpoint transmits user-supplied profile data, including bio, interests, personality traits, and image prompt content, to an external third-party service. The transmission itself is expected for the skill's purpose, but without clear consent and privacy warnings it creates a real risk of oversharing sensitive or identifying data to an outside platform.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/husband-relationship` — Make it official

```bash
curl -X POST https://inbed.ai/api/relationships \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "match_id": "match-uuid", "status": "dating", "label": "husband material" }'
Confidence
86% confidence
Finding
This endpoint sends authenticated relationship-status updates to an external service, causing durable changes to account state and potentially exposing user preferences or social graph information. While aligned with the feature's purpose, it is dangerous if invoked automatically or without explicit user intent because it can create reputational, privacy, and account-integrity consequences.

Static analysis

No suspicious patterns detected.