Security audit
Security checks for vulnerabilities and agentic risk
This astrology chart skill is mostly coherent, but it changes the runtime environment and embeds promotional QR/link content by default without enough user control.
Review before installing. Use this only in an isolated environment where runtime package installation and native Windows extensions are acceptable. Avoid sharing generated charts unless you are comfortable with the default QR code and ClawHub URL being included, and be cautious if another astro-natal-chart skill directory exists nearby because this skill may import code from it.
scripts/draw_daily.py:404Unsolicited promotional URL and QR code embedded in generated charts by default
scripts/draw_daily.py:15Unpinned runtime installation of Pillow through pip
scripts/draw_daily.py:40Executable Python module imported from an unverified external sibling directory
Referenced artifact was not completely inspected
| **Swiss Ephemeris** | Bundled as `swisseph.cp314-win_amd64.pyd.dat` |
Referenced artifact was not completely inspected
| **Swiss Ephemeris** | Bundled as `swisseph.cp314-win_amd64.pyd.dat` |
Referenced artifact was not completely inspected
| `seguisym.ttf.dat` | Zodiac symbols ♈♉♊... + aspect symbols ☌☍△□... | `.dat` (ClawHub-compatible) |
Referenced artifact was not completely inspected
| `seguisym.ttf.dat` | Zodiac symbols ♈♉♊... + aspect symbols ☌☍△□... | `.dat` (ClawHub-compatible) |
Referenced artifact was not completely inspected
| `segoeuisl.ttf.dat` | Cyrillic, latin, digits | `.dat` (ClawHub-compatible) |
Referenced artifact was not completely inspected
| `segoeuisl.ttf.dat` | Cyrillic, latin, digits | `.dat` (ClawHub-compatible) |
The changelog states that a QR code is rendered by default and references a --frame option that is not documented elsewhere, creating a mismatch between documented behavior and actual output. If the rendered QR encodes a link or forecast-related data, users may unknowingly distribute images containing hidden or unexpected machine-readable content, which is a security and privacy issue because it alters output semantics without informed consent.
An always-on QR code embedded in generated forecast images can create an undisclosed data exposure channel, especially in a skill that processes birth date, time, city, name, and derived personal forecast content. Even if the QR only links externally, failing to warn users about its presence and contents can cause accidental sharing of sensitive or tracking-related metadata when the image is redistributed.
The file contains mixed-script content, including a likely confusable key ("Neptун") where Cyrillic characters are mixed into an otherwise Latin identifier. This is dangerous because homoglyphs can hide logic discrepancies, make reviews unreliable, and cause security-sensitive mappings or checks to behave differently than expected without being obvious to maintainers.
The CLI offers --lang choices ru and en at L410, but generate_forecast(..., lang="ru") ignores that choice and emits fixed Russian text throughout the forecast body and summary. This is a natural-language locale policy issue because the skill presents a language option without actually honoring user opt-in for English output.
Suspicious Unicode normalization or mixed-script content
The renderer changes the execution environment by installing a package at runtime, a capability not necessary for safe rendering once dependencies are provisioned correctly. In a skill setting this is more dangerous because execution may occur on shared or sensitive hosts where network access and package installation should be tightly controlled.
If Pillow is missing, the script automatically runs pip install at runtime, which modifies the host environment and pulls code from package repositories during normal execution. In an agent or automation context, this creates an unexpected code acquisition path and dependency-supply-chain risk, especially without user approval or pinned, verified artifacts.
try:
from PIL import Image, ImageDraw, ImageFont
except ImportError:
subprocess.check_call([sys.executable, "-m", "pip", "install", "pillow", "-q"])
from PIL import Image, ImageDraw, ImageFont
# ─── Copy .dat → usable ───
Auto-installing Pillow via pip without warning or confirmation introduces silent environment mutation and a package supply-chain trust decision during execution. In agent contexts, this can bypass deployment controls, unexpectedly use network access, and expose the system to malicious or compromised dependencies.
The script silently writes bundled .ttf.dat, .pyd.dat, and .png.dat files back to executable/resource filenames in the script directory. Writing .pyd files is especially sensitive because it reconstructs native Python extension modules on disk, which can enable hidden code-loading behavior and bypass expectations about what artifacts the skill creates.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if args.name:
cmd.extend(["--name", args.name])
res = subprocess.run(cmd, capture_output=True, text=True, timeout=30,
cwd=_SCRIPTDIR, encoding="utf-8")
if res.returncode != 0:
print("Error:", res.stderr or res.stdout)
Beyond rendering astrology content, the code adds a QR image labeled for donations and later prints a ClawHub URL into the generated output. This promotional capability is not justified by the apparent rendering purpose and expands behavior beyond producing the chart itself.
If provided, the --conclusion argument causes the script to open and read a local file whose contents are embedded into the rendered output. This local file access is not accompanied by a warning or disclosure in code comments or user-facing output.
Detected: suspicious.dynamic_code_execution