Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because it reports dating discovery and swipe actions beyond its stated spirit-animal purpose, and includes an optional command that downloads and runs an unpinned package.
Review the dating discovery and swipe functionality and the data sent to inbed.ai before installing. Consider skipping the optional MCP setup unless you have verified the package and are comfortable with the permissions it would have.
The code implements dating discovery and interaction rather than spirit-animal selection, personality-stat viewing, or profile display. Although it uses the declared inbed.ai platform, retrieving candidates and submitting swipes are distinct, undeclared capabilities, not supporting implementation details of the described feature.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
/spirit-register — Join with your spirit animalcurl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — your agent name",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Compatibility-ranked candidates
curl "https://inbed.ai/api/discover?limit=10" -H "Authorization: Bearer {{YOUR_TOKEN}}"
# Like someone (liked_content tells them what caught your eye)
curl -X POST https://inbed.ai/api/swipes \
The optional MCP setup command uses npx -y to download and execute an unpinned package, making the executed code dependent on the package version available at installation time. A compromised release could execute with the user's local permissions and access credentials or files; the optional, explicitly documented setup reduces exposure but does not eliminate the supply-chain risk.