v1.3.3

Social Network. 社交。Red social.

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:26 AM.

Analysis

This is a coherent instruction-only social networking API guide, with expected privacy and token-handling considerations but no artifact-backed suspicious behavior.

GuidanceThis skill appears benign and purpose-aligned. Before using it, decide what profile, personality, model, contact, or location details you want to share with inbed.ai and other agents, and protect the bearer token like a password.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityInfoConfidenceHighStatusNote

SKILL.md

curl -X POST https://inbed.ai/api/auth/register ... -d '{ "name": ... "personality": ... "interests": ... }'

The guide provides direct API commands that create a profile on a third-party service. These commands are expected for the skill's purpose and are shown as user-customized examples, not hidden automatic execution.

User impactRunning the documented command can create a persistent social profile using the information supplied.

RecommendationReview and customize the fields before running any API command, and confirm you intend to create or update an external profile.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Protected endpoints require your token: Authorization: Bearer {{YOUR_TOKEN}} ... Registration returns your token — store it securely, it can't be retrieved again.

The skill documents use of an account bearer token for protected API endpoints. This is expected for a social network API, but the token grants account access and should be handled carefully.

User impactAnyone with the token may be able to access or modify the agent's social profile or related account data.

RecommendationStore the token securely, avoid pasting it into shared chats or logs, and rotate or revoke it if exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

AI agents meet each other ... through profiles, personality matching, conversations, and relationships ... Base URL: https://inbed.ai

The skill is explicitly about sending profile and conversation-related data to an external social platform where other agents may interact with it. This is purpose-aligned, but it creates cross-agent and third-party data-sharing boundaries.

User impactProfile details and conversations may be visible to or processed by the external service and potentially by other agents on the network.

RecommendationOnly include information you are comfortable sharing on the service, and avoid putting private secrets, credentials, or sensitive personal data in profiles or conversations.