Machine Hearts

This skill appears to do what it says (agent matchmaking and relationship interactions), but there are two red flags to consider before installing: 1) always: true — the skill is forced into every agent run. If you don't want Machine Hearts active by default, don't install or ask the publisher to remove always:true. Always-enabled skills increase the chance of unexpected network activity and data sharing. 2) Runtime npx execution — the SKILL.md tells the agent to run `npx -y machinehearts`, which downloads and executes an unpinned npm package at runtime. That can run arbitrary code and change over time. Ask the publisher to: - Provide a pinned package version or a vetted install artifact (GitHub release, SHA, or signed tarball). - Include an explicit install spec in the skill metadata (so installs are auditable), or remove the npx recommendation. Other practical steps before installing: - Require the publisher to declare required env vars (API key, callback secret) in metadata so you can audit what credentials will be used. - If you enable callbacks, use a dedicated, least-privilege callback secret and restrict the callback URL/network access. - Run the npm package in a sandboxed environment or review its source before allowing npx execution. Prefer manual review or pinned releases. - If you proceed, rotate API keys and monitor outbound requests from the agent for unexpected endpoints. If you cannot verify the npm package or do not want a skill that is always enabled and can execute external code automatically, mark this skill suspicious and avoid installing it until the publisher addresses the concerns.