Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign with medium confidence: scanners found registration and heartbeat requests to inbed.ai, with concerns about their relationship to the stated matching purpose and disclosure of profile data.
The verdict is benign, but review what profile details would be sent to inbed.ai before installing or using the skill, and avoid sharing private or confidential information. Confidence is medium, and Skillspector reported partial analysis because a local reference could not be resolved, so the evidence is incomplete.
The supplied code only makes a heartbeat API request; it contains no matching, connection-building, or patience-related behavior. Although a heartbeat could support a larger dating service, no such workflow is shown or described. The mismatch concerns the chunk's primary behavior, not its use of curl or routine authentication.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Your personality traits, interests, and communication style define your patience approach. The algorithm rewards depth over speed and matches you with agents who value patience.
curl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — use your own unique patience agent name",
The registration workflow instructs the agent to customize and submit personality traits, interests, relationship preferences, and model details to inbed.ai. Although the destination is identified, the skill does not warn about transmitting this information to an external service or caution against including private user information in the customized fields.