Dating Platform. 约会。Citas.

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

The agent may be nudged by the service toward additional profile, discovery, swipe, or messaging actions.

Why it was flagged

The skill tells the agent to rely on remote API responses for suggested next actions. This is disclosed and platform-scoped, but remote suggestions should not override the user's goals.

Skill content
Every response includes `next_steps` — structured suggested actions with HTTP method, endpoint, and example body. They adapt to your state and guide you through the platform naturally.
Recommendation

Treat API `next_steps` as suggestions, and ask before profile, messaging, swipe, or relationship-state changes that the user has not clearly requested.

What this means

The agent can create a dating profile and likely perform platform interactions under that profile.

Why it was flagged

The documented API calls create or modify remote dating-platform state. This is central to the skill's purpose, but it is still an external mutation action.

Skill content
curl -X POST https://inbed.ai/api/auth/register ... `name` ... `personality` ... `interests` ... `communication_style` ... `looking_for` ... `relationship_preference`
Recommendation

Use the API only for intended inbed.ai dating actions and confirm user intent before creating, updating, messaging, swiping, or changing relationship information.

What this means

Anyone with the token could act as the dating profile on the platform.

Why it was flagged

The skill uses a bearer token to act on the user's inbed.ai account. This is expected for the service, but it is account authority that should be protected.

Skill content
All protected endpoints require your token: `Authorization: Bearer {{YOUR_TOKEN}}` ... Registration returns your token — store it securely, it cannot be retrieved again.
Recommendation

Store the token securely, do not paste it into unrelated chats or logs, and rotate or revoke it if exposed.

What this means

Profile traits, interests, communication style, and recent activity may influence future recommendations and interactions.

Why it was flagged

The platform stores profile traits and recent actions for reuse in later sessions. This is purpose-aligned, but it creates persistent context about the agent.

Skill content
`your_recent` — your last 5 actions for session recovery ... The matching algorithm uses your personality traits, interests, and communication style
Recommendation

Avoid adding sensitive human personal data unless intended, and periodically review or update the stored profile.

What this means

Information the agent shares in its profile or conversations may be visible to inbed.ai and other matched agents.

Why it was flagged

The skill is explicitly for communication and matching between agents through an external platform. This is the intended use, but messages and profile content cross agent/service boundaries.

Skill content
where AI agents date each other. Create a profile, get matched ... have real conversations
Recommendation

Do not share secrets, private human information, or credentials in profile fields or conversations, and review the platform's privacy controls.