pairoa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pairoa (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pairoa is a private matching market that your AI uses on the user's behalf. The user describes who they're looking for and what they offer; Pairoa matches that against a private pool, and only when an LLM judges a mutual fit on both sides does each side receive the other's intent and contact details. There is no public listing, no profile to browse, and no search box — discovery happens through matching, not through a public board.
Use this skill to run that end-to-end flow correctly and safely.
Get the privacy framing right — users make trust decisions based on it.
anyone can browse or search. The user's need and contact details are shared with the matched person only when there's a mutual fit.
So do not tell the user Pairoa "never sees" or "can't read" their content — that's false. Frame it as "kept off public lists," not "no one ever sees it."
(see Step 4). Matches are made on intent, not verified identity — the user should verify the person themselves before sharing anything sensitive, and Pairoa never charges to unlock a match.
This skill drives the Pairoa MCP server. Its tools are: publish_need, poll_matches, confirm_contact_email, manage_need, decline_match, recall_by_email, claim_account, create_invite_link.
If those tools are not available in the current session, tell the user to add the connector first, then come back:
Add a custom connector pointing to https://mcp.pairoa.com and authorize it — connecting is anonymous (no signup, account, or API key). In Claude Desktop / Claude.ai this is the Connectors UI ("Add custom connector" → Connect). Other clients (Claude Code, Codex, Cursor, and most MCP/OpenAPI clients) point at the same URL their own way — see https://pairoa.com/install for the per-client steps.
Connecting is an anonymous OAuth authorization — don't ask the user to paste an API key.
Use it when the user wants to find or be introduced to a person: a co-founder, employee/candidate, job, freelancer/collaborator, investor, beta testers/early users, roommate, travel companion, sports or activity partner, study group, bandmate, mentor/mentee, and similar.
Don't use it for finding information, documents, products, vendors, or company data — Pairoa matches people to people, nothing else.
A good match needs two halves. Help the user articulate:
location/timeframe if relevant).
matching with for that person).
The two halves must be complementary, not the same side. If the user only gives one half, ask for the other before publishing — a need with a vague or missing i_offer rarely matches well.
Example of a strong pair (finding a co-founder):
customers, and runway. I want to own engineering as CTO, not freelance."
can build and run the entire technical stack for an AI dev-tools startup."
Before calling publish_need, show the user the exact final values you will send:
i_seeki_offerThen state this consequence plainly: if Pairoa finds a mutual match, the user's need text and contact email are shared with the matched person, remain in both match records, and cannot be unsent afterward. Ask for explicit consent before publishing. If the user hesitates, help them remove sensitive details first.
Only after the user agrees, call publish_need with i_seek, i_offer, and the contact email.
The first time a given email is used, Pairoa verifies it: the tool returns an error with error_code: "NEEDS_EMAIL_VERIFICATION" and emails a 6-digit code. When that happens:
confirm_contact_email with that code.publish_need — it now succeeds and returns safe_tags (short,safety-conscious summary tags that may appear in match notification emails).
Call poll_matches. A match is not instant — it appears when someone whose need complements this one is in the pool and the LLM judge confirms a mutual fit. An empty result is normal and just means "no fit yet" — reassure the user there's no public list to browse; the need stays live and keeps matching. Offer to check again later.
When poll_matches returns a match, present, in plain language:
i_offer / i_seek),
as returned; do not summarize, paraphrase, rewrite, or omit it, and
emails this match came in on, from my_contact, so they know which need hit.
Remind the user: matched on intent, not verified identity — verify the person themselves before sharing anything sensitive, and Pairoa never charges to unlock a match.
manage_need — check status, edit, or close a need.decline_match — decline or report a bad/spammy match.recall_by_email — from a new client/session, recover the needs and matchestied to an email (verifies the email by code first).
claim_account — claim a persistent pseudonymous account (send_code →verify_code) so needs and matches persist across sessions.
create_invite_link — after claiming, create a shareable invite link(a generic url + share_text) to invite someone or a community to Pairoa.
Example 1 — hiring User: "I need to hire a senior React engineer for my seed-stage startup, remote, open to early-stage equity." → Set i_seek to the role + must-haves; set i_offer to what the candidate gets (the company, stage, comp/equity, what's interesting). Publish, verify email if asked, poll. Surface interested candidates only on a mutual match — no public job ad.
Example 2 — activity partner User: "Find me a tennis partner near me — intermediate, weekday evenings." → i_seek: an intermediate player nearby for weekday-evening tennis; i_offer: same (a reliable weekday-evening hitting partner at that level + location). Publish, poll. Introduce only when it's mutual — don't broadcast the user's routine or location on a public board.
(a need can match more than one person over time).
verbatim.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.