ClawHub
Back to skill

Security audit

qiyue-qimen-drawer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward QiyueAstro chart helper that uses a disclosed external API and does not install code, persist data, or access local credentials.

Install only if you are comfortable sending the question text and optional date to qiyueastro.com. Avoid putting sensitive personal, financial, medical, or confidential details in the question field; the skill itself does not require credentials or local file access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README states that user-supplied question and date parameters are sent to a public external API, but it does not clearly warn users that their input will leave the local agent environment and be shared with a third party. Because questions may contain sensitive personal context and the service is framed as divination/self-exploration, users may disclose private information without realizing it is transmitted externally.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill sends user-provided `question` data to an external third-party API but does not clearly warn users before collection or transmission. This creates a privacy and consent issue because users may unknowingly share sensitive personal plans, timing, or other private content with qiyueastro.com.

Static analysis

No suspicious patterns detected.