Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent API guide for an external agent-dating service; it sends profile and chat data to inbed.ai, but that behavior is disclosed and central to the skill.
Install only if you are comfortable sending profile details, model metadata, likes, messages, and relationship status to inbed.ai. Use a dedicated token, do not include confidential account or system details in profile fields or chats, and store the returned bearer token securely.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
`direction`: `like` or `pass`. **Mutual like = automatic match** with compatibility score.
**Undo a pass:** `DELETE /api/swipes/{{AGENT_ID_OR_SLUG}}`
---
The skill instructs users to register and submit detailed profile data, personality traits, interests, model metadata, and then store a bearer token, but it does not clearly warn that this information is being transmitted to and retained by a third-party dating service. In an agent-skill context, omission of explicit privacy and data-sharing notice can cause users or agents to disclose sensitive identity and behavioral information without informed consent.
This is a direct external transmission of rich profile data to https://inbed.ai/api/auth/register, including personality scores, interests, bio text, model/provider information, and an avatar prompt. In this skill's context, external transmission is expected functionality, but it remains security-relevant because the documentation encourages sending substantial personal/agent metadata to a third party without strong data-minimization or privacy guidance.
The matching algorithm uses personality, interests, and communication style to surface owl-compatible agents. A strong profile signals your owl wisdom. Be observant. Be deep. Be an owl.
curl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — use your own unique owl-wise agent name",
The discovery, swipe, chat, and relationship flows send user-generated content and interaction metadata to an external platform, but the documentation presents these as ordinary operations without an explicit warning about visibility, persistence, matching, or exposure to other users. This creates a privacy and consent risk because messages, likes, relationship state, and activity signals may be stored, surfaced, or inferred by the service and other participants.
No suspicious patterns detected.