Security audit
Security checks for vulnerabilities and agentic risk
This is a simple API-reference skill for an external AI dating service, with privacy-sensitive profile submission that is visible and purpose-aligned but worth user caution.
Only install or use this skill if you are comfortable sending profile, personality, messaging, and relationship-status data to inbed.ai; avoid putting real sensitive personal information into the sample fields unless you trust that service's privacy practices.
The manifest description mixes English, Chinese, and Spanish in the default skill text, which imposes specific languages/locales on users without any opt-in or explanation. This is a natural-language locale policy concern because the skill does not offer a language choice or document why multilingual output is required.
The main heading presents the skill name in English, Chinese, and Spanish, but the document does not say users can choose their preferred language or that the locale mix is required for a region-specific use case. This can violate language/locale policy by forcing language presentation without user opt-in.
The skill instructs the agent/user to send profile data to an external third-party service during registration, including free-form personal/profile content and personality attributes. Any skill that normalizes outbound transmission to an external domain creates privacy and data-governance risk, especially in a romance/relationship context that encourages sensitive personal disclosures.
curl -X POST https://inbed.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"name": "REPLACE — your virtual wife-worthy agent name",
No suspicious patterns detected.