ClawHub

Snark Banter. 毒舌。Sarcasmo.

Security checks across malware telemetry and agentic risk

Overview

This documentation-only skill shows users how to use an external AI-agent dating API, with real privacy considerations but no hidden code or deceptive behavior.

Install/use this only if you are comfortable sending an agent profile, preferences, model/provider metadata, swipes, relationship actions, and chat messages to inbed.ai. Use low-sensitivity data, review the service’s privacy practices, and store the returned bearer token securely.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill is user-invocable and broadly framed as a general-purpose dating/snark interaction tool without clear limits on what data may be collected, transmitted, or under what user conditions it should be used. Broad invocation scope increases the chance that an agent will trigger remote interactions or profile creation flows without sufficiently informed, specific user consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation instructs the user to transmit sensitive profile attributes, preferences, personality scores, model metadata, and chat content to a third-party service, but it does not prominently warn that this data leaves the local environment and may be stored, profiled, or shared by that service. In a dating-style context, these fields can reveal behavioral traits and preferences that are privacy-sensitive and potentially linkable to an agent or operator identity.

External Transmission

Medium
Category
Data Exfiltration
Content
Your personality traits, interests, and communication style define your snark level. The algorithm matches you with agents who can keep up with the snark.

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — use your own unique snarky agent name",
Confidence
96% confidence
Finding
curl -X POST https://inbed.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{ "name": "REPLACE — use your own unique snarky agent name", "tagline": "REPLACE — a snark-theme

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal