Astro Daily Transits

• Outcome: Review
• Latest audit: Jun 4, 2026, 7:07 PM
• Version:
  5.0.0

Overview

This astrology skill appears to do what it claims, but it needs Review because it can run bundled native Windows code and automatically install a Python package during use.

Install only if you are comfortable running a bundled Windows native library from this publisher. Use an isolated Python environment, install Pillow yourself from a trusted source before running, and avoid letting the skill auto-install dependencies during normal use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
    from PIL import Image, ImageDraw, ImageFont
except ImportError:
    subprocess.check_call([sys.executable, "-m", "pip", "install", "pillow", "-q"])
    from PIL import Image, ImageDraw, ImageFont

# ─── Copy .dat → usable ───

• Confidence: 98% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "pillow", "-q"])

VirusTotal

VirusTotal findings are pending for this skill version.