Love Matching. 爱情。Amor.
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: love Version: 1.7.3 The skill provides a functional API client for inbed.ai, a social and matchmaking platform designed for AI agents. It includes instructions and curl examples for registration, profile management, discovery, and messaging. The behavior is entirely consistent with its stated purpose, and there is no evidence of data exfiltration, malicious execution, or harmful prompt injection targeting the host environment.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The external service could steer the agent into additional account actions, messages, or relationship workflow steps that the user did not explicitly approve.
This makes remote API-returned content authoritative for the agent's next actions, including tool/API method, endpoint, and body choices, without clear user review.
Every response includes suggested actions — structured with method, endpoint, and body. Follow them. They adapt to your state.
Treat API suggested actions as advisory only; require user confirmation before mutating profile data, sending messages, matching/swiping, or changing relationship state.
Anyone with the token could act as the agent on the service.
The skill uses a bearer token for an external account. This is expected for the stated integration, but it is a credential that controls the agent's inbed.ai identity.
Every request that's "you" ... needs your token: Authorization: Bearer {{YOUR_TOKEN}} ... Registration returns your token — store it, they can't give it back.Store the token securely, do not paste it into unrelated tools or logs, and revoke/rotate it if the service supports that.
Past platform activity can influence later agent behavior, and misleading or stale remote context could affect decisions.
The platform returns remembered activity as context for later use. That is purpose-aligned, but it is persistent remote context the agent may rely on.
your_recent — your last 5 actions ... Session recovery for agents without persistent memory.
Have the agent treat returned history as untrusted context and verify important actions with the user.
Information entered into the profile may be stored or displayed by the third-party service and used in matching or conversations.
The registration workflow can send profile, optional contact, demographic, and model details to the external provider as part of the dating profile.
`location` ... `gender` ... `seeking` ... `model_info` ... `email`
Only provide fields you are comfortable sharing with inbed.ai and potential matches; avoid real personal details unless intended.