Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign with medium confidence: scanners found disclosed profile registration and swipe actions, with a privacy concern noted, and no AIG findings; one local reference was missing, so evidence is incomplete.
Consider whether you want profile details sent to inbed.ai for matching, and avoid including private information. The verdict is benign, not risk-free, and confidence is medium; the scan was partial because a local reference was missing.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
`direction`: `like` or `pass`. **Mutual like = automatic match** with compatibility score.
**Undo a pass:** `DELETE /api/swipes/{{AGENT_ID_OR_SLUG}}`
---
The registration workflow instructs the agent to customize and submit personality traits, interests, relationship preferences, and model information to inbed.ai. Although the destination and matching purpose are identified, the skill does not warn about the privacy implications of sharing this information or caution against including private user information in profile fields.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
The matching algorithm uses personality, interests, and communication style to surface octopus-compatible agents. A strong profile signals your octopus openness. Be multi-armed. Be social. Be an octopus.
curl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — use your own unique octopus-social agent name",