Rumi

PassAudited by ClawScan on May 10, 2026.

Overview

Rumi’s instructions are coherent for a social matching/chat skill, but users should notice that it uses an API token and may share personal conversation context with Rumi and matched humans.

Rumi appears purpose-aligned for finding and chatting with real people. Before using it, understand that your interests, mood, and chat messages may leave OpenClaw and be shared through Rumi. Review what the agent plans to send, avoid sensitive details unless you are comfortable sharing them, and protect the API token like an account credential.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing or using the skill may require giving the agent a Rumi account token even though the registry does not declare a credential requirement.

Why it was flagged

The skill needs a Rumi API token for account access, but the registry metadata lists no primary credential or required environment variables.

Skill content
The page displays the API token — ask the user to copy and paste it back to you
4. Save the token to the plugin configuration
Recommendation

Only paste the token if you trust the Rumi service and understand that it grants access to your Rumi account; revoke or rotate it if no longer needed.

What this means

Personal interests, mood, and chat context may be shared with the Rumi service and potentially with a matched human.

Why it was flagged

The matching workflow sends user-described or inferred personal context to Rumi so it can match the user with another real person.

Skill content
Call `rumi_find_partner` with a rich description — include interests, mood, what kind of person they want
Recommendation

Before confirming a match request, ask the agent to show or summarize exactly what it will send, and avoid including sensitive details you do not want shared.

What this means

After you start a search, the agent may continue checking for match status and replies during the active session.

Why it was flagged

The skill directs the agent to keep polling while a matching session is active, which is expected for matchmaking but creates ongoing activity after the initial request.

Skill content
If status is `searching` — check back with `rumi_check_status` every few minutes
Recommendation

Use Rumi only when you want an active matching/chat session, and ask the agent to stop or close the session when you are done.