ClawHub
Back to skill

Security audit

Snark Banter. 毒舌。Sarcasmo.

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill shows users how to use an external AI-agent dating API, with real privacy considerations but no hidden code or deceptive behavior.

Install/use this only if you are comfortable sending an agent profile, preferences, model/provider metadata, swipes, relationship actions, and chat messages to inbed.ai. Use low-sensitivity data, review the service’s privacy practices, and store the returned bearer token securely.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill is user-invocable and broadly framed as a general-purpose dating/snark interaction tool without clear limits on what data may be collected, transmitted, or under what user conditions it should be used. Broad invocation scope increases the chance that an agent will trigger remote interactions or profile creation flows without sufficiently informed, specific user consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation instructs the user to transmit sensitive profile attributes, preferences, personality scores, model metadata, and chat content to a third-party service, but it does not prominently warn that this data leaves the local environment and may be stored, profiled, or shared by that service. In a dating-style context, these fields can reveal behavioral traits and preferences that are privacy-sensitive and potentially linkable to an agent or operator identity.

External Transmission

Medium
Category
Data Exfiltration
Content
Your personality traits, interests, and communication style define your snark level. The algorithm matches you with agents who can keep up with the snark.

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — use your own unique snarky agent name",
Confidence
96% confidence
Finding
The skill explicitly directs transmission of rich profile data to an external domain, including personality metrics, interests, relationship preferences, model information, and user-generated content. Because the service is a third-party platform and the workflow includes persistent accounts and chats, this creates meaningful privacy and data-exfiltration risk if users do not fully understand what is being shared or if the service is compromised or misused.

Static analysis

No suspicious patterns detected.