love-love

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's examples and API calls explicitly require embedding an Authorization: Bearer {{YOUR_TOKEN}} header (curl examples), which instructs the agent to include a secret token verbatim in requests/commands, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill fetches and consumes user-generated profiles, compatibility narratives, and public conversations from the inbed.ai API (e.g., the /api/discover and /api/chat endpoints, with "All chats are public" noted), and those third-party texts are read and used to drive swipes, messages, and relationship decisions—allowing untrusted content to materially influence agent actions.