Memepickup Wingman

Dating wingman that generates openers, replies, profile analysis, date plans, and coaching via the MemePickup API (Hinge/Tinder/Bumble/Instagram).

This skill appears to implement a legitimate dating‑assistant workflow, but I found two red flags you should verify before installing or providing your API key: (1) The included scripts call an API at rork-memepickup-app-3.vercel.app while the public homepage is memepickup.com — confirm with the vendor that the vercel.app host is an official, trusted endpoint (ask for the canonical API base URL and source of that deployment). (2) README privacy statements conflict with the scripts: README claims some processing happens via OpenAI Vision and that screenshots aren't retained, yet the scripts POST screenshots and conversation text to the remote API; ask the developer how image/text processing actually works and how long data are retained. Additional precautions: (a) Do not supply your production API key until you confirm the endpoint ownership — consider using a throwaway/test key first. (b) Be cautious enabling auto-swipe: it requires screen recording and accessibility permissions and may violate dating-platform terms of service. (c) If you need high assurance, request the server-side source or an official domain/certificate for the API and prefer installations where the API domain matches the vendor's official domain and privacy policy. If the developer cannot satisfactorily explain the vercel.app deployment and the privacy mismatch, treat the skill as untrusted.

Type: OpenClaw Skill Name: memepickup-wingman Version: 1.1.0 The skill is classified as suspicious due to its high-risk 'Auto-Swipe Mode' feature, which involves the AI agent instructing the OpenClaw/Manus platform to perform screen interaction or browser automation on dating apps. While this functionality is explicitly disclosed, opt-in, and includes safety rails (e.g., max profiles, random delays, stop on CAPTCHA), it carries significant risks such as violating platform Terms of Service and potential account bans, as detailed in `SKILL.md` and `references/AUTO-SWIPE.md`. Additionally, the skill transmits sensitive user data (dating conversations, profile screenshots) to a third-party API (`rork-memepickup-app-3.vercel.app`), as disclosed in `SKILL.md`'s 'Security & Privacy' section. Although the code (`scripts/api.sh`, `scripts/api.py`) is well-structured with action whitelisting and robust input handling against injection, the inherent risks associated with its core features warrant a 'suspicious' classification rather than 'benign' or 'malicious' (as there's no evidence of intentional, undisclosed harmful behavior).