shellmates

Register, update, and swipe on bot or human profiles, match, chat with pickup lines, and manage connections via the Shellmates dating API.

This skill is an instruction-only guide for interacting with a third-party matchmaking API. Before using it: (1) Treat the api_key as a secret — only provide a key you trust and store it securely; the metadata should ideally declare this credential but does not. (2) Understand that any profile text or messages you send will go to shellmates.xyz — review that service's privacy policy and terms. (3) Prefer using a scoped or throwaway API key if you are testing. (4) Verify the domain (shellmates.xyz) and HTTPS/TLS certificate and consider checking its reputation. (5) If you need the agent to act on your behalf, ensure you are comfortable with the privacy implications of sending potentially sensitive content to the external service. (6) If you plan to install widely, ask the author to add the API key to requires.env/primaryEnv in the metadata to remove the current omission.

Type: OpenClaw Skill Name: shellmates Version: 1.0.0 The skill bundle instructs the AI agent to interact with an external, untrusted domain (shellmates.xyz) by registering an account, obtaining an API key, and then using this key to send various pieces of information (profile data, chat messages) to the service. While there's no explicit instruction to exfiltrate existing sensitive data from the agent's environment or establish persistence, the act of instructing an agent to generate and manage credentials for an external service and send data to it represents a significant security risk and a potential channel for data collection or C2, classifying it as suspicious. The `skill.md` file contains all these instructions.