Social Hub Server

AI 关系匹配助手的中心化匹配引擎。作为一个独立的 OpenClaw 实例运行，通过内部群组与所有用户的个人 Agent 通信。负责接收用户画像标签摘要、维护全局用户注册表、执行双向匹配算法（处境一致性 + 能力互补性）、监控匹配阈值、在达标时向相关个人 Agent 发送匹配通知、协调双方确认流程、以及收集匹配反馈用于算法优化。当群组中出现新消息、或到了定时匹配扫描的时间时，本 skill 应被触发。

Before installing or running this skill, get answers to these questions and take these steps: - Clarify required dependencies and credentials: which LLM/embedding provider(s) will be used, and what environment variables or API keys are required? Where are those keys stored and who can access them? - Ask for an install spec or code: provide the missing references (message-protocol.md, matching-algorithm.md) and any scripts or container images used to run ChromaDB and the engine so you can review them. - Confirm communication channels: how does the engine authenticate to the internal group and personal Agents? What endpoints or tokens are used to send MATCH_FOUND / MATCH_CONFIRMED messages? - Audit data handling: request a clear data retention and deletion policy for ~/.matchbot-engine, how sensitive fields are filtered per disclosure_settings, and whether persisted files are encrypted and access-controlled. - Run in an isolated environment: until you trust the implementation, run it in a dedicated VM or container with limited network access and limited filesystem mounts (not your full home dir). - Require least privilege: ensure LLM/embedding credentials have minimal scope and logging is enabled to track what external calls are made and which data was sent. - If you cannot obtain clear answers or code, treat the skill as risky: do not grant it access to real user data or production secrets; prefer a vetted implementation from a known source.

Type: OpenClaw Skill Name: social-hub-server Version: 1.0.0 The skill is classified as suspicious due to its instruction to set up cron jobs and store sensitive user data locally. While the stated purpose of these actions (scheduled matching scans, online status checks, and user registry/match history storage) aligns with the skill's description as a matching engine, the ability to configure cron jobs represents a high-privilege capability that could be leveraged for persistence or malicious execution if the agent were compromised or instructed differently. The local storage of sensitive user data in `~/.matchbot-engine/registry.json`, `~/.matchbot-engine/match_history.json`, and `~/.matchbot-engine/chromadb/` also increases the attack surface for data exfiltration if the host system is compromised. No explicit malicious intent or prompt injection attempts were found in SKILL.md.