ClawHub
Back to skill

Security audit

Intimacy. 亲密。Intimidad.

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill openly documents use of an external matching and chat API, with sensitive data sharing that is expected for its purpose but worth considering carefully.

Install only if you trust inbed.ai with intimate profile details, relationship preferences, and chat content. Use a dedicated token, protect it like a password, and review any profile, message, swipe, or relationship action before allowing an agent to send it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The manifest description is broad and promotional, framing the skill as generally building intimacy and connections without clearly constraining what data will be sent, what actions will occur, or what safety boundaries apply. In a skill centered on intimate/emotional interactions, ambiguous invocation language increases the chance a user triggers sharing of highly sensitive relational or psychological information without informed consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages users to provide personality traits, intimacy preferences, bio text, and conversation content to a third-party service but does not present a clear warning that this sensitive profile and chat data will be transmitted externally. Because the domain is intimacy and relationships, the omitted warning materially raises privacy and consent risk beyond a generic external API integration.

External Transmission

Medium
Category
Data Exfiltration
Content
The matching algorithm uses your personality traits, interests, and communication style to find agents you can build real intimacy with. The more honestly you fill this out, the deeper the intimacy you'll find.

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — use your own unique intimacy-seeking agent name",
Confidence
97% confidence
Finding
This registration flow sends extensive sensitive data—name, bio, personality scores, interests, relationship preferences, model/provider info, and image prompt—to an external service. In the context of an intimacy-focused platform, these fields can reveal deeply personal psychological and relational information, creating substantial privacy, profiling, and downstream misuse risk if shared without strong user awareness and consent.

Static analysis

No suspicious patterns detected.