Bumble

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.6

Overview

The skill is mostly disclosed Bumble automation, but it automatically changes account location and can perform sensitive account actions with limited confirmation safeguards.

Install only after reviewing the sensitive behaviors carefully. Use it only with your own Bumble account and a Remote Browser Service you trust, assume the service can observe Bumble activity, explicitly approve any send, unmatch, auth, location, debug, or photo-export action, and clear or log out of the stored session when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes capabilities that handle network access, session reuse, local file output, and browser/MCP-style automation, but it does not declare permissions or constraints for those operations. That mismatch weakens reviewability and consent boundaries, making it easier for a high-risk skill to perform sensitive actions without explicit operator awareness.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The README discloses behavior that goes beyond normal session/auth and messaging operations: the skill changes the Bumble account location to San Francisco automatically after session start. In a dating app context, location is sensitive account data that affects user visibility, matching, and privacy, so silently altering it without explicit user approval is a real security/privacy issue rather than a harmless implementation detail.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The CLI exposes a generic `tap <text>` primitive that can click arbitrary visible UI text in the authenticated Bumble browser session, which goes beyond the declared purpose of bounded Bumble account operations. In a high-privilege session that can message, unmatch, and navigate account flows, this creates a capability-expansion surface that could be abused to trigger unintended actions the skill author did not explicitly model or safeguard.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The `snapshot` command exposes raw page structure and interactive node data for the live authenticated session, which is broader than the manifest's stated operations. That data can reveal hidden controls, internal refs, and sensitive page content that enable follow-on misuse or data harvesting beyond normal Bumble management tasks.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The debug pathway dumps page text, interactive elements, and saves a full screenshot of the authenticated Bumble session to disk. Because Bumble contains private messages, profile details, and potentially sensitive account state, this creates unnecessary data-exposure and retention risk outside the skill's stated user-facing functions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The client exposes unrestricted navigation to arbitrary URLs, while the skill is described as Bumble-focused session automation. In an agent skill context, this weakens purpose limitation and can be abused to drive the remote browser to attacker-controlled sites, enabling phishing, unintended data access, or exfiltration through the browser session.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The README instructs users to export profile photos to a local directory but does not warn that this writes third-party personal data to disk, where it may persist, be backed up, or be accessed by other local users or processes. Because the skill handles dating-profile content, exporting images increases privacy and data-handling risk and should be clearly disclosed and constrained.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that the skill sets location to San Francisco without user choice or opt-in. In the Bumble context this is more dangerous because location influences account behavior and exposure on a real-person social/dating platform, creating privacy, consent, and potential account-integrity concerns.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The profile photo export feature saves other users' photos to a local directory, creating a durable copy of personal data outside the Bumble interface. Even if the photos are already visible to the account, exporting them increases privacy risk, retention risk, and the chance of secondary misuse without a clear warning or consent checkpoint.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to set the account location to a fixed San Francisco coordinate without user choice or justification. Changing a dating-app location affects who can see or match with the account and may misrepresent the user’s whereabouts, creating both privacy and account-integrity risks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill downloads other users' profile photos and writes them to a local directory without any built-in consent prompt, warning, or data-handling guardrails. In this context, exporting and persisting personal images increases privacy risk because it turns transient in-app viewing into durable local storage that can be copied, retained, or misused.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The `unmatch` flow performs an irreversible destructive account action with no explicit user confirmation at the API/CLI boundary before execution. In a dating-app context, accidental or malicious invocation can permanently sever a conversation and remove access to the match, causing immediate user harm and loss of relationship/contact opportunity.

Session Persistence

Medium

• Category: Rogue Agent

Content

- If Bumble is already authenticated, do **not** run the auth flow again.
- If you gettin `get-started` or `auth` pages then start "Auth flow"
- Re-authenticate only when Bumble is clearly on `get-started`, `auth`, or SMS-confirmation pages.
- For non-auth actions, resume the stored session only; if Bumble is logged out, return an error instead of triggering auth.
- If Bumble is on a CAPTCHA screen, do **not** treat that as a normal logged-in state.
- If Bumble reaches a passkey screen after SMS verification, only **Not Now** may be used automatically; do **not** create or enroll a passkey automatically.
- Do **not** log out unless there is a significant reason.

• Confidence: 84% confidence
• Finding: Persisting and reusing an authenticated Bumble session allows the skill to access private messages, matches, and account state without re-authentication on each action. In the context of a remote browser service, weak session isolation or accidental reuse across operators could expose highly sensitive dating data or enable unauthorized actions.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.