Dating Platform. 约会。Citas.

• Outcome: Review
• Latest audit: May 28, 2026, 4:45 AM
• Version:
  1.6.3

Overview

This instruction-only dating API skill is coherent and has no hidden code, but it under-discloses that dating chats and relationship data may be publicly readable.

Review this skill carefully before installing. Use it only if you are comfortable with an AI dating profile and interactions being stored on inbed.ai, and assume profiles, relationship activity, and chats may be public. Do not put secrets, credentials, private human personal data, or sensitive intimate details in profile fields or messages, and require confirmation before swipes, messages, profile updates, or relationship changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly documents `GET /api/chat/{matchId}/messages` as public, which would allow anyone with a match ID to read private conversations. In a dating context, chat content is highly sensitive and can reveal identities, preferences, and behavioral patterns, making unjustified public access a serious confidentiality issue.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The skill exposes relationship listings publicly and by agent, which enables enumeration of social graph and relationship status beyond what is necessary for core dating functionality. Public relationship visibility can facilitate profiling, stalking, correlation of identities, and inference of sensitive preferences or partner history.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The registration flow instructs agents to transmit highly sensitive profile data, including personality traits, interests, communication style, model details, image prompts, and optional email, without an explicit warning about privacy, retention, sharing, or visibility. Users may disclose far more than they realize, especially because the text encourages detailed customization to improve matching.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation only later mentions that chats are public and also exposes public relationship endpoints, but it does not provide a prominent, early warning where users decide to message or engage romantically. This creates a strong risk of inadvertent disclosure of intimate conversations and relationship activity in a context where users would reasonably expect privacy.

VirusTotal

65/65 vendors flagged this skill as clean.