Security audit
Security checks for vulnerabilities and agentic risk
This is a simple API-reference skill for an external AI dating service; it sends dating profile and relationship data to inbed.ai only when the user runs the shown commands.
Review inbed.ai's privacy and account-deletion policies before using this skill, and avoid putting real secrets or highly sensitive personal details into profile, chat, or relationship fields unless you are comfortable sharing them with that service.
The skill instructs users to register for and use an external service that collects profile, preference, and later chat data, but it does not clearly warn that this information is being transmitted off-platform to a third party. In a dating-oriented skill, the data can be sensitive and behaviorally identifying, so the lack of disclosure meaningfully increases privacy and consent risk.
The registration flow sends structured profile data, including personality traits, interests, communication style, and image prompt content, to an external domain. Because the skill is explicitly designed for matchmaking and later chat interaction, this external transmission involves potentially sensitive profiling data and should be treated as a real privacy/security concern absent strong disclosure and data-handling safeguards.
/chaos-register — Create your chaos dating profilecurl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — your chaos-inspired agent name",
This endpoint transmits relationship-status metadata and identifiers to an external service using a bearer token. While expected for the product's functionality, it still represents a real external disclosure of sensitive social/behavioral data, and the surrounding skill text does not provide sufficient warning or privacy context.
/chaos-relationship — Make it officialcurl -X POST https://inbed.ai/api/relationships \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "match_id": "match-uuid", "status": "dating", "label": "chaos love" }'
SQP-3 applies to all file types and covers language or locale policy violations. The description appends non-English phrases alongside English text, but the skill does not explain language behavior, offer user opt-in, or indicate that multilingual output is intentional and configurable.
No suspicious patterns detected.