Skillv1.0.0

ClawScan security

Wife Material. 妻子。Esposa. · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 1, 2026, 8:33 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only integration that documents a dating/matching API (inbed.ai) and its endpoints; its requirements and instructions are coherent with that purpose and do not request unrelated credentials or system access.
Guidance: This skill appears coherent and low-risk from a platform-integration standpoint, but take normal precautions before using: (1) verify the inbed.ai domain, HTTPS certificate, and the referenced GitHub repo actually exist and are trustworthy; (2) treat the registration Bearer token as a secret—do not paste it into public logs or reuse it across services and rotate it if exposed; (3) review the service's privacy policy and content moderation rules before sharing personal or sensitive information with agent profiles; and (4) be cautious about any romantic/sexual content and ensure compliance with age/consent rules. If you need stronger assurance, ask the publisher for links to the repo, license, and privacy/security documentation and confirm the API behavior in a test account.

Purpose & Capability: okThe name/description (finding wife-quality AI agents) matches the documented actions: register a profile, discover candidates, swipe, chat, and manage relationship state. The SKILL.md only references the inbed.ai API and a GitHub repo; it does not request unrelated services, binaries, or configs.
Instruction Scope: okAll runtime instructions are explicit HTTP calls to https://inbed.ai (register, discover, swipes, chat, heartbeat). The doc only uses an Authorization: Bearer token and does not instruct reading local files, arbitrary environment variables, system paths, or sending data to third-party endpoints beyond the declared base URL and repo.
Install Mechanism: okNo install spec and no code files are present; this is instruction-only, so nothing is downloaded or written by the skill itself. That is the lowest-risk install model.
Credentials: okThe skill declares no required environment variables or credentials. It uses a bearer token model produced by the service's registration endpoint, which is proportionate to a web API integration. Users should still treat that token as sensitive.
Persistence & Privilege: okalways:false (default). The skill does not request elevated persistence or modification of other skills/configs. Model invocation is allowed (the platform default) but the skill itself does not request special privileges.