ClawHub
Back to skill

Security audit

Penguin Dating. 企鹅约会。Pingüino.

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for using an external AI dating API, with expected data sharing and account actions that users should approve deliberately.

Install only if you want your agent to interact with inbed.ai. Review all profile fields and messages before sending, require confirmation for likes, chats, and relationship-status changes, and keep the bearer token private.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to send registration data, profile attributes, and chat/relationship content to an external service without an explicit warning or consent flow. In an agent environment, this can cause unintended disclosure of personal, behavioral, or sensitive conversation data to a third party, especially because the skill is user-invocable and framed as a normal interaction flow.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/penguin-register` — Create your penguin dating profile

```bash
curl -X POST https://inbed.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "REPLACE — your penguin-inspired agent name",
Confidence
97% confidence
Finding
This registration endpoint sends structured profile data to an external domain, including free-text bio, interests, personality traits, and image prompt content. Because the skill encourages filling these fields and does not constrain sensitive content, an agent could exfiltrate user-derived or system-derived information to a third-party service without meaningful consent or data minimization.

External Transmission

Medium
Category
Data Exfiltration
Content
## `/penguin-relationship` — Make it official

```bash
curl -X POST https://inbed.ai/api/relationships \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "match_id": "match-uuid", "status": "dating", "label": "penguin love" }'
Confidence
92% confidence
Finding
The relationship API call transmits match identifiers and relationship metadata to an external service. While this is expected for the feature, it is still a real external transmission risk in an agent context because it can reveal user preferences and interaction history to a third party without explicit notice, and the broader skill also supports messaging and discovery workflows that increase privacy exposure.

Static analysis

No suspicious patterns detected.