Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

大六壬技能

v2.0.0

大六壬排盘与断卦技能。支持月将加时、起四课三传、排天将神煞、断课分析。用于人事占卜、失物寻人、出行吉凶、婚姻事业等预测。

0· 120·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md documents invoking a Python script at ~/.openclaw/skills/liuren-skill/scripts/liuren_pan.py, but the bundle contains only index.js (Node). Either the SKILL.md is outdated or required Python scripts are missing. That mismatch is not proportional to the described purpose (a prediction tool should include the executable it documents).
!
Instruction Scope
Instructions only ask to run a local Python script with --date/--question/--json flags (no external endpoints or extra files). However, because the documented script path does not exist in the package, an agent following these instructions may search the user's home for that path or attempt to run non-existent code. The instructions therefore grant ambiguous discretion and mismatch the shipped code.
Install Mechanism
There is no install spec (instruction-only), which is low-risk. However, the presence of index.js alongside a Python-centric SKILL.md indicates packaging inconsistency — there is no clear, executable install or entrypoint described in the files provided.
Credentials
The skill declares no required environment variables, credentials, or config paths. There is no evidence it requests unrelated secrets or system credentials.
Persistence & Privilege
always is false and there are no indications the skill requests elevated or persistent platform privileges. Autonomous invocation is allowed by default but not excessive here.
What to consider before installing
Do not install or enable this skill yet. Key issues: - SKILL.md instructs running a Python script at ~/.openclaw/skills/liuren-skill/scripts/liuren_pan.py, but the distributed files only include index.js (Node). Ask the publisher which runtime is intended and request the missing Python script or a corrected SKILL.md with a Node entrypoint. - The included index.js contains non-ASCII punctuation and probable syntax/typo errors (object keys and a malformed property in getShenSha) that will likely make the code fail if executed. Ask for a fixed, runnable implementation and a clear entrypoint. - There are no requested credentials or network calls in the files, so direct exfiltration risk appears low — but because of the packaging mismatch, verify the actual runtime before executing anything on your machine. What to request from the author before proceeding: 1) A corrected SKILL.md that matches the shipped code and shows the exact command to run (node index.js or the Python script if included). 2) The missing scripts (if Python is intended) or a packaged Node CLI that can be executed, plus a clear list of files created under ~/.openclaw during install. 3) A signed or well-known source (the GitHub repo link in SKILL.md should be checked) and assurance that the code has no network calls or secret access. If you cannot obtain these, test only in a sandboxed environment and inspect the actual runtime files before enabling autonomous invocation.

Like a lobster shell, security has layers — review code before you run it.

chinese-culturevk971sngtwm2rrsb440rn4q7mwh83x63rdivinationvk971sngtwm2rrsb440rn4q7mwh83x63rlatestvk97dmjdbpneayfs32at8am4b8s845ng4liurenvk971sngtwm2rrsb440rn4q7mwh83x63r

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments