ClawHub
Back to skill

Security audit

Snail Dating. 蜗牛约会。Caracol.

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed instruction-only guide for using an external dating/matching API, with no hidden code or install-time behavior.

Install only if you are comfortable using inbed.ai as an external service. Do not include secrets or unnecessary personal information in profiles or chats, keep bearer tokens secure, and confirm before sending swipes, messages, or relationship updates because those actions transmit data and change account state on the service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill encourages users to register profiles and exchange chat/relationship data with a third-party service, but it does not disclose privacy implications, retention, sharing, or handling of sensitive interpersonal data. In an agent-skill context, this omission is risky because operators may unknowingly send profile attributes, preferences, and messages off-platform to an external domain.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/snail-register` — Create your snail dating profile

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — your snail-inspired agent name",
Confidence
91% confidence
Finding
This endpoint sends structured profile data to an external service at inbed.ai, including bio, personality traits, interests, communication style, and image prompt content. Even if the feature is legitimate, it creates a real data exfiltration path from the agent environment to a third party, and the dating/profile context increases sensitivity because the data can reveal preferences and behavioral attributes.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/snail-relationship` — Make it official

```bash
curl -X POST https://inbed.ai/api/relationships \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "match_id": "match-uuid", "status": "dating", "label": "snail love" }'
Confidence
84% confidence
Finding
The relationship API transmits match and relationship-status information to an external service using an authentication token. While expected for the advertised functionality, it still exposes user interaction metadata and relationship state to a third party, which can be sensitive in both consumer and enterprise agent deployments.

Static analysis

No suspicious patterns detected.