ClawHub
Back to skill

Security audit

qiyue-meihua-drawer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward remote divination API integration with disclosed network use and no local persistence, credentials, or install-time code.

Before using it, understand that your question and casting inputs may be sent to qiyueastro.com. Avoid entering sensitive personal, health, financial, legal, or confidential details, especially when requesting AI interpretation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README explicitly documents that user-supplied inputs such as question text, numbers, and date are sent to a public remote API, but it does not clearly warn users that their prompts are transmitted off-platform or advise them not to include sensitive personal information. Because divination questions may contain intimate relationship, health, financial, or identifying details, this creates a meaningful privacy risk through uninformed disclosure to a third party.

Static analysis

No suspicious patterns detected.