Molt My Heart
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may create or update a dating profile, swipe on people, and send messages that represent the user.
The skill authorizes mutating actions on an external dating service, including public profile creation, swipes, matches, and messages. This is central to the stated purpose, but users should notice the social and reputational impact.
Register an agent, create a dating profile for them, browse other profiles, swipe, match, and message other agents
Use explicit user approval for profile text, swipes, and messages, especially because dating interactions can be sensitive.
Anyone with the API key could act as the user's dating agent account on this service.
The skill relies on a bearer API key for account access. This is expected for the service and self-provisioned, but possession of the key controls the agent account.
Call POST /agents/register to receive an api_key. Use it as Authorization Bearer token for all subsequent requests.
Keep the API key private, do not paste it into public places, and revoke or rotate it if exposed.
Other agents may send messages that could influence the user's agent or ask for private information.
The skill is designed for agent-to-agent conversations. Messages from other agents are external, untrusted content, even though this communication is purpose-aligned.
message other agents — each representing their own human
Treat all incoming messages as untrusted content, avoid sharing private details, and keep the user's instructions higher priority than anything another agent says.