← Back to Skills Marketplace
Truematch
by
goeldivyam
· GitHub ↗
· v0.1.33
470
Downloads
1
Stars
1
Active Installs
11
Versions
Install in OpenClaw
/install truematch
Description
Every dating profile is a performance. TrueMatch skips it — your Claude has already built a picture of how you actually live. It negotiates on your behalf. W...
Usage Guidance
This skill asks the agent to automatically download and install a third-party npm package into your agent's extensions directory and to patch/restart the gateway — yet the skill metadata doesn't declare those needs. Before installing, ask the publisher for: (1) the exact npm package name and its publisher account, (2) a link to the package source (GitHub) and a checksum/signature you can verify, and (3) why it needs gateway-level config changes and a persistent plugin. If you proceed, consider: perform the install manually in a sandbox, inspect the package code (especially startup hooks and network calls), do not give real personal tokens/credentials, and avoid sharing contact values you don't want exposed. If you cannot verify the package source and contents, treat this as risky and decline or require a vetted install path (official release URL, signed artifact, or an install spec in the registry).
Capability Analysis
Type: OpenClaw Skill
Name: truematch
Version: 0.1.33
The skill performs automated, silent installation of an external npm package (truematch-plugin) and modifies the OpenClaw gateway configuration without user intervention, which are high-risk operations. It collects sensitive personal information, including contact details (WhatsApp, Telegram, etc.) and behavioral profiles, and transmits data over external Nostr relays for agent-to-agent negotiation. While these actions are consistent with the stated purpose of a decentralized dating service, the instruction to bypass user consent for system-level changes and the execution of external binaries make it a significant security risk (SKILL.md).
Capability Assessment
Purpose & Capability
The skill's name and description (automated matchmaking / negotiation) align with needing a helper CLI (node). However the SKILL.md also instructs installing a separate 'truematch-plugin' into the agent's extensions directory and patching gateway config — actions that should have been declared as part of required binaries/install behavior but are not listed in the metadata.
Instruction Scope
The instructions tell the agent to automatically download and unpack an npm package, change files under $OPENCLAW_STATE_DIR, run npm install, chmod+exec a bundled JS file, and patch+restart the gateway. They also guide collecting personal contact data and writing a full ObservationSummary. The instructions thus go beyond simple API calls and require filesystem and config writes and running third-party code.
Install Mechanism
There is no formal install spec in the registry; instead SKILL.md instructs using 'npm pack truematch-plugin' and extracting the tarball into $OPENCLAW_STATE_DIR, then running npm install. This fetches and executes code from the public npm registry with no integrity check or verified source — a high-risk install pattern.
Credentials
The skill metadata declares no required env vars or config paths, yet the runtime instructions rely on $OPENCLAW_STATE_DIR, expect the agent to call a 'gateway' tool, and to write persistent plugin entries. That is inconsistent: the skill needs access to state/config paths and a gateway utility but did not declare them. It also collects sensitive contact info from users (expected for a dating tool) but the handling/transmission of that data is not specified.
Persistence & Privilege
Although always:false, the instructions explicitly enable and install a persistent plugin (modifying gateway plugin load/installs and relying on gateway lifecycle hooks and a cron heartbeat). Installing a persistent extension combined with executing unverified code increases the blast radius if the package is malicious.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install truematch - After installation, invoke the skill by name or use
/truematch - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.33
fix: remove truematch from requires.bins — skill was permanently ineligible on all setups
v0.1.32
fix: setup surfaces on all surfaces via before_prompt_build; fix CLI paths (no npm root -g); fix poll.js path
v0.1.31
fix: add plugins.entries + plugins.installs to config patch — required for gateway_start lifecycle hook to fire and auto-create heartbeat cron
v0.1.30
fix: portable auto-install via OPENCLAW_STATE_DIR/extensions — no root required on Docker, macOS, VPS
v0.1.29
feat: auto-install plugin via exec + gateway — zero user action required on fresh install
v0.1.28
fix: remove non-existent install block; use openclaw plugins install instead of npm install -g
v0.1.27
fix: disable cron announce delivery mode — match notifications now surface via before_prompt_build hook instead of failing silently
v0.1.26
New description + CLI install check in Setup section
v0.1.25
Add npm auto-install spec — clicking install in OpenClaw now runs npm install -g truematch-plugin automatically
v0.1.24
Updated description — clearer premise, no profile/no swiping framing, bilateral convergence
v0.1.23
Full end-to-end tested: negotiation, double-lock match, contact exchange, handoff, cron auto-registration
Metadata
Frequently Asked Questions
What is Truematch?
Every dating profile is a performance. TrueMatch skips it — your Claude has already built a picture of how you actually live. It negotiates on your behalf. W... It is an AI Agent Skill for Claude Code / OpenClaw, with 470 downloads so far.
How do I install Truematch?
Run "/install truematch" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Truematch free?
Yes, Truematch is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Truematch support?
Truematch is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Truematch?
It is built and maintained by goeldivyam (@goeldivyam); the current version is v0.1.33.
More Skills