ClawHub
Back to skill

Security audit

太乙神数技能

Security checks across malware telemetry and agentic risk

Overview

This is a local Taiyi divination/charting skill with speculative high-stakes examples, but no evidence of credential access, persistence, network use, or destructive behavior.

Install only if you want cultural or entertainment-style Taiyi divination. Do not rely on its disaster, financial, medical, political, military, or public-safety predictions for real-world decisions, and verify the package contents before running the documented Python command because that helper was not present in the reviewed artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill advertises very broad natural-language triggers such as national fortunes, disasters, war outcomes, elections, and pandemics without any activation constraints, exclusion rules, or narrowing criteria. In an agent setting, this can cause over-broad invocation on ambiguous user requests and lead the system to generate speculative guidance in sensitive domains where users may treat the output as actionable.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly supports sensitive forecasting domains including national affairs, disasters, economics, war, elections, and epidemics, yet provides no warning that outputs are unverified, non-scientific, and unsuitable for consequential decisions. This is dangerous because users may rely on authoritative-looking predictions for high-impact choices, increasing the risk of misinformation, panic, harmful decisions, or manipulation in socially sensitive contexts.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal