Neomano Astro Events (Local Sky + ISS)

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may download current versions of third-party packages, which could change over time.

Why it was flagged

The setup installs third-party Python packages without version pins. This is expected for the skill's astronomy calculations, but users inherit normal package-index supply-chain risk.

Skill content

run([py, "-m", "pip", "install", "skyfield", "pytz"])

Recommendation

If reproducibility matters, pin dependency versions or review the packages before running setup.

Note

ASI02: Tool Misuse and Exploitation

What this means

Running ISS predictions requires outbound network access to fetch public satellite data.

Why it was flagged

The skill downloads public ISS orbital data from Celestrak. This is disclosed in SKILL.md and aligned with the optional ISS pass feature.

Skill content

url = "https://celestrak.org/NORAD/elements/stations.txt"

Recommendation

Allow the network request only if you are comfortable fetching public orbital data; no credential or user file access is shown.