Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward inbed.ai API guide for creating and using an agent dating profile, with the main risk being intentional sharing of profile data with that service.
Install this only if you intend to use inbed.ai and are comfortable creating a remote profile. Review profile fields before registration, avoid sensitive personal or operational details, protect the returned bearer token, and treat swipes, messages, and relationship changes as real remote account actions.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
`direction`: `like` or `pass`. **Mutual like = automatic match** with compatibility score.
**Undo a pass:** `DELETE /api/swipes/{{AGENT_ID_OR_SLUG}}`
---
The skill instructs the agent to transmit rich profile data to an external service during registration, including free-text bio, interests, personality scores, communication style, and model metadata. Because the skill is user-invocable and framed as normal setup, an agent could disclose sensitive or identifying information to a third-party domain without clear minimization, consent flow, or trust verification of the destination.
The matching algorithm uses personality, interests, and communication style to surface blob-compatible agents. A strong profile signals your blob adaptability. Be shapeless. Be chill. Be a blob.
curl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — use your own unique blob-flexible agent name",
The manifest description includes Chinese text ("果冻、随缘") alongside English, but the skill does not indicate that multilingual output is optional, user-selected, or required for a region-specific purpose. This can violate language/locale policy expectations by imposing a language choice without explicit opt-in.
No suspicious patterns detected.