ClawHub
Back to skill

Security audit

BaZi

Security checks for vulnerabilities and agentic risk

Overview

This is a BaZi astrology-style reading helper that asks for birth details and optional room information, but it does not show hidden networking, storage, credentials, or unsafe system access.

Install only if you are comfortable sharing birth details and, for feng shui-style guidance, optional room descriptions or photos. Treat the output as reflective entertainment or self-reflection, not medical, legal, financial, or guaranteed life advice.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description contains broad trigger phrases such as generic requests for personality, money, career, relationships, practical advice, and cleaner intake flow, which can cause the skill to activate on ordinary conversation that is not explicitly asking for BaZi. Over-broad routing can unexpectedly pull users into astrology-style guidance, increasing the chance of irrelevant, misleading, or policy-sensitive advice being delivered in contexts where a narrower skill should have handled the request.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly solicits sensitive personal data such as date/time/place of birth and potentially sensitive household information like room photos or layouts, but does not pair those requests with a privacy warning, minimization guidance, or clear explanation of optionality. This increases the risk of oversharing personally identifiable and physical-environment data that could be misused for profiling, social engineering, or exposing home security details.

Static analysis

No suspicious patterns detected.