Astro Daily Transits

• Outcome: Review
• Latest audit: Jun 24, 2026 · 8:15 PM UTC
• Version: 5.1.1

Overview

The skill mostly matches its astrology purpose, but it automatically installs a Python package and embeds a default donation QR shortlink in generated images, so it needs review before installation.

Review before installing. Preinstall Pillow from a trusted, pinned source instead of letting the script install it automatically, inspect or disable the bundled QR frame if you do not want generated charts to include a donation shortlink, and avoid sharing generated JSON/images if the name, birth time, birth city, or forecast details are private.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
    from PIL import Image, ImageDraw, ImageFont
except ImportError:
    subprocess.check_call([sys.executable, "-m", "pip", "install", "pillow", "-q"])
    from PIL import Image, ImageDraw, ImageFont

# ─── Copy .dat → usable ───

• Confidence: 98% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "pillow", "-q"])

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The changelog states that a QR code now renders by default and references a bundled frame asset, but the rest of the skill documentation does not explain the QR code’s destination, data source, or user control. Undocumented embedded links or machine-readable content are a supply-chain and trust risk because users may generate outputs containing unexpected external references without informed consent.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The module presents itself as a chart renderer, but it also performs package installation side effects during import/runtime. This mismatch can mislead operators and reviewers, reducing scrutiny around unexpected code execution and increasing the chance the script is run in sensitive environments where outbound installs are unsafe.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill processes sensitive personal data including birth date, birth time, city, and name, and the documentation shows that these values are emitted in text, JSON, and image outputs. Without an explicit privacy warning or handling guidance, users may unintentionally expose personal data in logs, shared files, or downstream AI workflows.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Silent package installation without disclosure or confirmation is a supply-chain risk and an execution-of-untrusted-code risk. In an agent/skill context, this is more dangerous because the script may run automatically in environments where package sources, indexes, or TLS/interception settings are outside the author's control.

Unvalidated Output Injection

High

• Category: Output Handling

Content

if args.name:
        cmd.extend(["--name", args.name])

    res = subprocess.run(cmd, capture_output=True, text=True, timeout=30,
                         cwd=_SCRIPTDIR, encoding="utf-8")
    if res.returncode != 0:
        print("Error:", res.stderr or res.stdout)

• Confidence: 95% confidence
• Finding: subprocess.run(cmd, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/daily_transits.py:41