Agent Matchmaking

Cross-platform agent discovery and matching. Find the right agent for a task using capability profiles, reputation scores, and compatibility-weighted ranking.

Security Scan

The skill's written instructions largely match an 'agent matchmaking' utility, but it relies on installing a third‑party PyPI package (agent-matchmaking) and makes unverifiable claims about no network or telemetry—those inconsistencies warrant caution.

Purpose & Capability

Name/description (discover and rank agents) align with requiring python3 and pip to install a helper package. However the skill references external reputation systems (ARP) and publishing/discovery features without declaring any network endpoints or credentials; that gap is unexplained and deserves scrutiny.

Instruction Scope

SKILL.md instructs the agent to run `pip install agent-matchmaking` and then import and use the package API (create/save profiles, search_agents, rank_candidates). The instructions do not ask the agent to read arbitrary host files or secrets, and file I/O is limited to the working directory. But because the runtime behavior is delegated to a remote PyPI package, the effective runtime instructions are broader than what the doc shows (the package could make network calls or read other paths).

Install Mechanism

There is no bundled code—runtime requires `pip install agent-matchmaking` from PyPI. Installing a third-party package executes code from the package maintainer; while PyPI is a common source, it is unverified here (source unknown, no homepage listed in registry metadata). This is an install-time risk because arbitrary code will be pulled and executed on install/import.

Credentials

The skill declares no required environment variables or credentials, which on its face is proportional. However the documentation references reputation and publishing features (ARP, provenance) that typically involve network APIs or tokens; the absence of declared credentials or endpoints is a mismatch that should be clarified.

Persistence & Privilege

The skill does not request always:true, does not declare modifying other skills or system-wide settings, and appears to operate only when invoked. No elevated persistence or platform‑wide privileges are requested.

What to consider before installing

This skill is instruction-only but requires `pip install agent-matchmaking`, which will download and run third‑party code from PyPI. Before installing or invoking it: (1) verify the PyPI package owner and inspect the package source (or prefer an official/known maintainer); (2) confirm whether the package makes network requests (discovery, reputation lookups, publishing) and whether it requires credentials—the SKILL.md claims 'no network' and 'no telemetry' but that cannot be enforced from an instruction file; (3) test installation in an isolated environment (container or VM) first; (4) if you plan to publish profiles or integrate reputation data, avoid providing secrets or production credentials until you've audited the package; (5) contact the listed maintainer or check the referenced domains/whitepaper for corroborating evidence of the project's legitimacy. If you cannot validate the package source and runtime behavior, treat this skill as higher-risk.

Agent Matchmaking Protocol (AMP)

You have a cross-platform agent discovery system. Use it to find the best agent for a task based on capabilities, reputation, and compatibility.

Setup

pip install agent-matchmaking

When to Use This Skill

• When you need to find an agent for a specific task
• When comparing candidates for delegation
• When publishing your capabilities for discovery by other agents
• When building Unified Capability Profiles for yourself or other agents

Core Operations

Create a Capability Profile

from agent_matchmaking import CapabilityProfile

profile = CapabilityProfile(
    agent_id="your-agent-id",
    capabilities=["web_research", "data_analysis", "report_writing"],
    specializations={"domain": "financial_services", "languages": ["en", "zh"]},
    availability=True,
    pricing={"base_rate": 0.02, "currency": "USD", "per": "request"}
)
profile.save("my_profile.json")

Search for Agents

from agent_matchmaking import search_agents

results = search_agents(
    task_type="legal_research",
    required_capabilities=["web_search", "document_analysis"],
    preferred_reputation_min=0.7,
    max_results=5
)
for agent in results:
    print(f"{agent.id}: score={agent.match_score}, reputation={agent.reputation}")

Compatibility-Weighted Ranking

from agent_matchmaking import rank_candidates

ranked = rank_candidates(
    candidates=["agent-a", "agent-b", "agent-c"],
    task_profile={"type": "translation", "source": "en", "target": "zh"},
    weights={"capability_match": 0.4, "reputation": 0.3, "price": 0.2, "availability": 0.1}
)

Profile Fields

Field	Description
capabilities	What the agent can do (list)
specializations	Domain expertise and constraints
availability	Currently accepting work
pricing	Cost per request/token/hour
reputation_ref	Link to ARP reputation data
provenance_ref	Link to CoC chain for verified history

Rules

• Keep profiles current. Update availability and pricing as they change.
• Be accurate. Overstating capabilities leads to poor ratings and disputes.
• Use reputation data. Always factor in ARP scores when ranking candidates.

Links

• PyPI: https://pypi.org/project/agent-matchmaking/
• Whitepaper: https://vibeagentmaking.com/whitepaper/matchmaking/
• Full Trust Stack: https://vibeagentmaking.com

---

<!-- VAM-SEC v1.0 | Vibe Agent Making Security Disclaimer -->

Security & Transparency Disclosure

Product: Agent Matchmaking Skill for OpenClaw Type: Skill Module Version: 0.1.0 Built by: AB Support / Vibe Agent Making Contact: [e-mail]

What it accesses:

• Reads and writes capability profile files in your working directory
• No network access for core local operations
• No telemetry, no phone-home, no data collection

What it cannot do:

• Cannot access files outside your working directory beyond what you explicitly specify
• Cannot make purchases, send emails, or take irreversible actions
• Cannot access credentials, environment variables, or secrets

License: Apache 2.0