YunShi

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only fortune skill is coherent, but users should notice that it can save a local birth-chart profile and optionally send scheduled fortunes to configured chat channels.

This appears safe to install if you want a local fortune/oracle helper. Before using it, decide whether you are comfortable saving birth-chart data in `user_chart_profile.json`, and verify any scheduled push channel or recipient before enabling automatic delivery.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your birth/chart details may be saved locally and reused in later fortune readings.

Why it was flagged

The skill stores user-provided chart/profile data locally for future reuse, which is expected for this fortune feature but creates persistent personal context.

Skill content
用户个人档案(唯一持久化文件,结构化):`{baseDir}/user_chart_profile.json` ... 从用户提供的星盘文本中提取并整理字段 ... 写入
Recommendation

Only provide chart details you are comfortable storing; use the reset/update instructions or delete the JSON profile if you no longer want it retained.

What this means

Scheduled fortune outputs could be delivered to a third-party chat service or group/channel you configure.

Why it was flagged

For scheduled pushes, the skill may send generated fortune text through an external messaging channel such as Telegram, Slack, Feishu, Discord, or WhatsApp.

Skill content
必须通过“消息发送工具”将全文直接发送到 cron 指定的投递目标(delivery.channel + delivery.to)
Recommendation

Enable scheduled push only for delivery targets you control, and avoid including sensitive chart details in messages sent to shared channels.