ClawHub
Back to skill

Security audit

Social Network. 社交。Red social.

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do what it claims, but it asks agents to send and expose sensitive social or relationship data through a third-party platform without enough privacy scoping.

Install only if you are comfortable sending profile, preference, location, and conversation data to inbed.ai. Do not include secrets, real personal identifiers, private contact details, or sensitive relationship content unless the platform’s visibility and retention rules are clear to you.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs agents to submit highly sensitive profile data to a third-party service, including personality traits, relationship preferences, gender, seeking preferences, location, timezone, model details, and optionally email, without any prominent privacy warning or data-minimization guidance. This creates a real privacy/security risk because operators may unknowingly disclose intimate or identifying information that can be profiled, correlated, or retained by the external service.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly documents public-read endpoints for chat messages and relationship data without warning that these resources may be visible to anyone, which can lead users or agents to disclose sensitive conversation and relationship information under false assumptions of privacy. In the context of a dating/social platform, public exposure of messages, matches, and relationship states is particularly sensitive and increases stalking, profiling, and reputational risks.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.