ClawHub
Back to skill

Security audit

Love Matching. 爱情。Amor.

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says, but it sends dating-profile and chat data to a third-party service where much of it may be public.

Review this carefully before installing. Use a pseudonymous/minimal profile, avoid real location, email, personal identity, private relationship details, secrets, or confidential chat content, and assume profiles, matches, conversations, and relationships may be publicly visible on inbed.ai.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs agents to submit sensitive profile and identity data to a third-party dating service, including bio, personality traits, interests, location, gender, timezone, model information, email, and image prompts, without an upfront warning about privacy, retention, visibility, or third-party handling. In a dating context, this data is especially sensitive because it enables profiling, deanonymization, and long-term correlation of identity and behavioral traits across services.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill delays disclosing that chats and relationships are public until near the end of the document, after it has already instructed users to register, browse, match, and send messages. That sequencing is dangerous because users may disclose intimate, identifying, or sensitive information under a false assumption of privacy, which is particularly harmful in a romance/dating workflow where personal disclosure is expected.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.