Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
太乙神数技能
v2.0.0太乙神数排盘技能。支持太乙积年、起局、排十六神将、计算主客算、断局分析。用于国运预测、天灾预警、经济大势、战争胜负等宏观预测。
⭐ 0· 104·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The declared purpose (太乙神数排盘) is coherent with the included algorithmic code, but SKILL.md instructs running a Python script (~/.openclaw/.../taiyi_pan.py) which is not present. The only code file is index.js (Node). The language mismatch (Python commands vs JS implementation) is inconsistent and unexplained.
Instruction Scope
Runtime instructions explicitly tell the agent/user to run a Python script from a path in the user's home directory (~/.openclaw/skills/...). That script is not included. The instructions don't ask for credentials or external endpoints, but they reference a specific filesystem path and a binary (python3) that may not exist; an agent following these instructions could error or attempt to create/modify files in the user's home. The SKILL.md does not provide fallback behavior to the included index.js.
Install Mechanism
There is no install spec (instruction-only style). That is lowest-risk from an installer perspective: nothing downloads or executes arbitrary remote installers. However, the packaging mismatch (instructions vs included files) remains a problem.
Credentials
The skill requests no environment variables, no credentials, and no config paths. There is no obvious request for sensitive access. This is proportionate for a local divination/algorithmic skill.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request elevated/persistent platform privileges. Nothing in the manifest indicates modification of other skills or global agent settings.
What to consider before installing
Do not install or run this skill as-is. Key issues to resolve before trusting it: 1) SKILL.md commands run a Python script (~/.openclaw/skills/taiyi-skill/scripts/taiyi_pan.py) that is missing from the package — ask the author to include the Python script or update the docs to explain how index.js is intended to be used. 2) The included index.js contains multiple clear bugs and inconsistencies (bad/mismatched function calls, object literals and punctuation using fullwidth/non-ASCII colons/commas, functions expecting different parameters, and logic that treats arrays as strings). These will cause runtime errors or unexpected behavior. 3) Verify the claimed GitHub repository and obtain a corrected, versioned release with matching language (Python vs Node), a clear install/run README, and preferably tests or example runs. 4) Because the SKILL.md references running a script from your home directory, be cautious: scripts run from your home can read/write user files — confirm the script only accesses its own files and does not exfiltrate data. 5) The good news: there are no declared credentials, no network endpoints in the code, and no installer that fetches remote code; the primary risk here is broken/incomplete code rather than obvious exfiltration, but broken code can still cause harm (data overwrite, unexpected file IO). If you want to proceed safely: request a fixed package (matching language and files), review the script source before running, and test it inside an isolated sandbox/container rather than on a production machine.Like a lobster shell, security has layers — review code before you run it.
chinese-culturevk97b4yjksddsfqcc0hh9rjae7h83xw0xdivinationvk97b4yjksddsfqcc0hh9rjae7h83xw0xlatestvk9796n811fye8e3yh43k1ns10x845gtbtaiyivk97b4yjksddsfqcc0hh9rjae7h83xw0x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
