Astro Natal Chart

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:57 AM UTC
• Version: 4.3.7

Overview

This astrology chart skill mostly matches its stated purpose, but it auto-installs software at runtime and adds a default QR/donation frame to generated charts.

Review before installing. This skill performs the advertised astrology calculation and rendering, but run it only in an environment where you are comfortable with a bundled native Windows extension and avoid relying on its runtime auto-install behavior. Install Pillow yourself in an isolated environment, inspect or disable the default QR/frame before sharing generated charts, and avoid processing third-party birth data or AI conclusion files without consent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/draw_wheel.py:37

Finding

Default Promotional URL and QR Code Injection into Generated Charts

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/draw_wheel.py:10

Finding

Automatic Installation of an Unpinned Dependency at Runtime

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/draw_wheel.py:767

Finding

Path Traversal Through Unsanitized Output Name

Content

View full analysis

.png` suffix, which limits control over the final filename. Nevertheless, the attacker can influence parent directories and can create or overwrite a matching PNG file wherever the process account has write permission. ### Attack Path 1. An attacker controls or influences the `--name` value passed to `draw_wheel.py`. 2. The attacker supplies traversal components, for example a value shaped like `..\..\target\report`. 3. The script replaces spaces but preserves the traversal sequences and separators. 4. The manipulated value is concatenated with the fixed filename suffix. 5. `os.path.join` combines the unsafe relative path with the hardcoded workspace path. 6. `img.save()` resolves the traversal and writes the PNG outside the intended workspace, provided the destination exists and is writable. ### Impact Assessment The process can create or overwrite a PNG-suffixed file outside the intended output directory with the privileges of the current user. The vulnerability does not provide arbitrary file contents—the writte ...[truncated 338 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (16)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

md

| `scripts/swisseph.cp314-win_amd64.pyd.dat` | Bundled Swiss Ephemeris binary (2 MB) | MSVC++ Redist |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly describes a workflow where birth date, birth time, birth location, and derived chart data are sent to an AI for analysis, but it does not warn users that this is sensitive personal data or advise on safe handling, retention, or third-party disclosure. Because birth data is personally identifying and potentially sensitive, users may unknowingly transmit it to external models, logs, or shared files without informed consent or privacy safeguards.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The text explicitly states that draw_wheel.py only calls natal_chart_swe.py and renders returned data, implying a narrowly scoped renderer. Elsewhere in the same file, the documented CLI for draw_wheel.py includes --conclusion FILE and --frame FILE, and the changelog says a QR code/frame now renders by default, which means the renderer also ingests arbitrary local files beyond natal_chart_swe.py JSON output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Calling the tool 'Renderer only' suggests it merely transforms natal chart data into an image. However, the quick reference immediately below documents --conclusion FILE and --frame FILE inputs, and the changelog notes default QR/frame rendering, showing the script also consumes unrelated local content and incorporates it into the output.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 451)May include surrounding context.

md

- **Zodiac symbols instead of text abbreviations**: wheel now shows ♈♉♊♋♌♍♎♏♐♑♒♓ instead of AR/TA/GE/etc.
- **2x resolution**: canvas is now 2840×1800 (was 1420×900), all fonts and elements scaled proportionally
- **Planet legend moved to bottom-left**: no longer overlaps the chart wheel; placed below info box
- **Full interpretation fits**: larger text panel (1040px) with bigger fonts ensures all 12 houses + aspects render without truncation
- Added get_symbol_font() helper: uses Segoe UI Symbol for reliable zodiac glyph rendering
- Version bumped: 3.1.0 → 3.2.0

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

A chart-rendering script should not silently acquire new code from the internet at runtime, because that introduces a broader capability than its stated purpose and changes the host environment. Even if intended for convenience, it permits external dependency execution and undermines reproducibility and reviewability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script automatically runs pip install at runtime without user consent, causing network access and code retrieval from a package index during normal execution. This expands the trust boundary from the local skill to external package infrastructure and can result in unreviewed code execution or environment modification.

Content

Scanner excerpt · scripts/draw_wheel.py (reported line 13)May include surrounding context.

python

try:
    from PIL import Image, ImageDraw, ImageFont
except ImportError:
    subprocess.check_call([sys.executable,"-m","pip","install","pillow","-q"])
    from PIL import Image, ImageDraw, ImageFont

_ttf_dir = os.path.dirname(os.path.abspath(__file__))

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Silent package installation is risky because users are not informed that execution may download and install software, modify the Python environment, and run third-party package code. In an agent skill context, undisclosed environment-changing behavior is especially concerning because it exceeds user expectations for a rendering utility.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/draw_wheel.py (reported line 55)May include surrounding context.

python

else:
    print(f"Warning: frame not found at {frame_path}")

res = subprocess.run([sys.executable, os.path.join(_SCRIPTDIR,"natal_chart_swe.py"),
    args.date, args.time, args.city, "--json"],
    capture_output=True, text=True, timeout=30, cwd=_SCRIPTDIR, encoding="utf-8")
if res.returncode != 0: print("Error:", res.stderr or res.stdout); sys.exit(1)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The docstring frames this file as producing a natal chart wheel and panels, but the code launches a separate Python script rather than only rendering provided data. Spawning external processes is a significant capability that is not signaled by the file's stated role as a drawing script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains user-facing strings, labels, and examples entirely in Russian, and the CLI usage/help also assumes Russian-language interaction. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

For markdown files, SQP-2 applies when the documentation omits warnings about behaviors that could affect user data or system integrity. These lines state that the skill auto-restores .ttf files on first run via shutil.copy2, which implies writing files to disk, but the changelog provides no caution or disclosure about that side effect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The default city is set to a Russian locale value while the script otherwise supports both English and Russian, which embeds a locale assumption into the user experience. This can conflict with language/locale policy expectations because the user is not explicitly opting into a region-specific default or being told why that locale is chosen.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script saves a generated image file to a hard-coded location on disk, which is a file write affecting user data/workspace state. While it prints the path after saving, there is no earlier warning, prompt, or descriptive comment near the save behavior informing the user where output will be written.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This code embeds only two fixed locale datasets, Russian and English, and does not contain any natural-language indication that the user can choose or opt into a language. Under the policy, locale constraints can be a concern when a skill effectively enforces specific languages without explicit user choice or justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/natal_chart_swe.py:41