ClawHub
Back to skill

Security audit

qiyue-lenormand-drawer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Lenormand card-reading API integration with a minor privacy/scoping caveat around broad activation and sending questions to QiyueAstro.

Install only if you are comfortable with user questions being sent to QiyueAstro when using draws or AI readings. Avoid entering highly personal details, and consider tightening activation wording so the skill runs only when the user clearly asks for Lenormand cards or this specific reading tool.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation guidance is broad enough to trigger on generic yes-or-no, relationship, or decision-seeking prompts even when the user did not explicitly request Lenormand content. This can cause unintended tool activation and unnecessary transmission of user prompts or questions to the external QiyueAstro service, increasing privacy and consent risk.

Static analysis

No suspicious patterns detected.