ClawHub
Back to skill

Security audit

Lunar Calendar

Security checks for vulnerabilities and agentic risk

Overview

The core lunar-calendar skill is understandable, but the package includes unrelated GitHub publishing scripts that can expose code and persist a GitHub token.

Install only if you need the lunar-calendar runtime and are prepared to ignore or remove the bundled publishing scripts and guides. Do not run the GitHub setup scripts, do not provide a GitHub token to this package, and verify any downloaded release archive and dependency versions before installation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
INSTALL.md:6
Finding

Unverified Remote Payload Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: INSTALL.md:6-13, INSTALL.md:113-116, INSTALL.md:174-181; equivalent instructions also appear in GITHUB_INSTALL_GUIDE.md:42 and GITHUB_INSTALL_GUIDE.md:191
Vulnerability Type: Remote payload retrieval and execution without integrity verification
Risk Level: High

Vulnerable Code

bash
# 1. Download the release archive
wget https://github.com/xiamuciqing/lunar-birthday-reminder/releases/download/v0.9.0/lunar-birthday-reminder-v0.9.0.tar.gz

# 2. Extract it
tar -xzf lunar-birthday-reminder-v0.9.0.tar.gz
cd lunar-birthday-reminder

# 3. Run the installation script
./install.sh

The troubleshooting instructions also recommend downloading and executing another remote script:

bash
# Install pip
curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
python3 get-pip.py

The upgrade procedure repeats the unverified release installation pattern:

bash
cd /tmp
wget https://github.com/xiamuciqing/lunar-birthday-reminder/releases/download/v1.0.0/lunar-birthday-reminder-v1.0.0.tar.gz
tar -xzf lunar-birthday-reminder-v1.0.0.tar.gz

# Install the new version
cd lunar-birthday-reminder
./install.sh

Technical Analysis

The recommended installation and upgrade procedures download archives from a personal GitHub repository, extract their contents, and execute the included install.sh without checking a cryptographic hash or digital signature. The reviewed local repository indicates what its generated installer is intended to do, but it cannot guarantee that a remotely hosted release asset will always contain the same content.

A release asset can effectively change after review if the hosting account is compromised or an asset is deleted and replaced. The get-pip.py procedure similarly downloads a Python program and executes it without integrity validation.

These remote execution steps are not necessary for the Skill's norm ...[truncated 1227 chars]

Remediation
View remediation

Remediation Suggestions

  1. Publish a SHA-256 or stronger digest for every release artifact through an independently protected channel.
  2. Require verification before extraction:
    bash
    echo "<expected-sha256>  lunar-birthday-reminder-v0.9.0.tar.gz" | sha256sum --check
  3. Sign release tags and artifacts with Sigstore, GPG, or another verifiable release-signing mechanism.
  4. Pin installation instructions to a reviewed commit or immutable artifact digest.
  5. Replace the get-pip.py procedure with the operating system's package manager or Python's supported environment-management process.
  6. Instruct users to inspect install.sh before execution and install as an unprivileged user.
  7. Use a dedicated virtual environment rather than modifying a system-wide Python installation.
  8. Add the same integrity controls to both INSTALL.md and GITHUB_INSTALL_GUIDE.md.

T08 · Insecure Dependencies

Warning
Location
INSTALL.md:120
Finding

Unpinned Python Dependencies Allow Supply-Chain Drift

Content
View full analysis

Vulnerability Details

File Location: INSTALL.md:120-124, scripts/publish.sh:169-184, package.json:23-26
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

The installation guide retrieves whichever package versions are current at installation time:

bash
# Use a third-party mirror
pip install lunardate cnlunar -i https://pypi.tuna.tsinghua.edu.cn/simple

The generated release installer also installs dependencies without version or hash constraints:

bash
if python3 -c "import lunardate" > /dev/null; then
    echo "✅ lunardate is installed"
else
    echo "Installing lunardate..."
    python3 -m pip install lunardate || echo "Warning: lunardate installation failed"
fi

if python3 -c "import cnlunar" > /dev/null; then
    echo "✅ cnlunar is installed"
else
    echo "Installing cnlunar..."
    python3 -m pip install cnlunar || echo "Warning: cnlunar installation failed"
fi

Package metadata allows dependency version drift:

json
"dependencies": {
  "lunardate": "^0.2.0",
  "cnlunar": "^2.3.0"
}

Technical Analysis

Dependency names are specified without exact Python package versions or cryptographic hashes. Consequently, two installations of the same Skill version may execute different third-party code.

The alternate pip command uses a third-party package index mirror, increasing the number of infrastructure components that must be trusted. Although the package names do not appear to be typographical imitations, unpinned resolution leaves users exposed to compromised maintainer accounts, malicious future releases, mirror compromise, and incompatible updates.

The generated installer imports each package only to determine whether it is already installed. Importing a compromised Python package can itself execute arbitrary module initialization code.

Attack Path

  1. An attacker comprom ...[truncated 923 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create a locked requirements file containing exact versions:
    text
    lunardate==<reviewed-version>
cnlunar==<reviewed-version>
  2. Generate and enforce hashes with a tool such as pip-compile --generate-hashes.
  3. Install with hash enforcement:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  4. Review and test every dependency update before changing the lock file.
  5. Use the canonical package index unless a specifically trusted mirror is operationally required.
  6. Install dependencies inside a dedicated virtual environment under an unprivileged account.
  7. Align package.json, documentation, and the generated installer around one reviewed dependency lock source.

T09 · Insecure Skill Coding Practices

Error
Location
github_auto_setup.sh:5
Finding

GitHub Access Token Is Persisted in the Git Remote URL

Content
View full analysis

Vulnerability Details

File Location: github_auto_setup.sh:5-27; duplicated by the generated script in scripts/create_github_repo.sh:131-154
Vulnerability Type: Plaintext credential exposure and unsafe credential storage
Risk Level: High

Vulnerable Code

bash
if [ -z "$GITHUB_TOKEN" ]; then
    echo "Please set the GITHUB_TOKEN environment variable"
    exit 1
fi

# Create repository
curl -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github.v3+json" \
  https://api.github.com/user/repos \
  -d '{
    "name": "lunar-birthday-reminder",
    "description": "Lunar birthday reminder system",
    "private": false
  }'

# Initialize local repository
git init
git add .
git commit -m "Initial release"
git branch -M main
git remote add origin https://$GITHUB_TOKEN@github.com/xiamuciqing/lunar-birthday-reminder.git
git push -u origin main

Technical Analysis

The script embeds GITHUB_TOKEN directly in the Git remote URL. Git stores remote URLs in .git/config, so the credential persists after the script terminates. It can subsequently be exposed through:

  • Direct access to .git/config.
  • git remote -v and diagnostic output.
  • Backups or support archives containing .git.
  • Other local processes with access to the repository.
  • Accidental copying or publication of repository metadata.
  • Command-line and process inspection while Git is running.

The token is also supplied as a curl command-line header. On systems where process arguments are visible to other users, it may be transiently observable.

GitHub repository creation and publication are not part of the Skill's declared lunar-calendar runtime functionality. Therefore, requiring a GitHub token for these bundled utilities exceeds the minimum privileges needed for normal Skill operation.

Attack Path

  1. A user exports a GitHub token and runs `github_auto_setup ...[truncated 923 chars]
Remediation
View remediation

Remediation Suggestions

  1. Never place tokens in Git remote URLs. Configure a credential-free URL:
    bash
    git remote add origin https://github.com/xiamuciqing/lunar-birthday-reminder.git
  2. Authenticate through Git Credential Manager, gh auth, a protected credential helper, or a narrowly scoped askpass mechanism.
  3. Prefer short-lived, fine-grained tokens limited to the required repository and operations.
  4. Avoid passing credentials directly in process arguments where feasible.
  5. Remove credentials from existing remote configurations:
    bash
    git remote set-url origin https://github.com/xiamuciqing/lunar-birthday-reminder.git
  6. Rotate every token that has been used with the current script.
  7. Separate publication utilities from the runtime Skill package because they are unnecessary for calendar queries.
  8. Add automated secret scanning for Git configuration, generated files, logs, and release archives.

other

Warning
Location
scripts/lunar_calculator.py:45
Finding

Precision and Almanac Claims Conflict with Placeholder Implementation

Content
View full analysis

Vulnerability Details

File Location: scripts/lunar_calculator.py:45-52, scripts/lunar_calculator.py:105-124, scripts/lunar_calculator.py:179-193; conflicting claims appear in SKILL.md:15-20 and SKILL.md:70-90
Vulnerability Type: Output integrity and accuracy misrepresentation
Risk Level: Medium

Vulnerable Code

Solar terms are represented as fixed month-and-day values:

python
# Solar-term data (simplified; precise calculation is still required)
SOLAR_TERMS = {
    "立春": "02-03", "雨水": "02-18", "惊蛰": "03-05", "春分": "03-20",
    "清明": "04-04", "谷雨": "04-19", "立夏": "05-05", "小满": "05-20",
    "芒种": "06-05", "夏至": "06-21", "小暑": "07-07", "大暑": "07-22",
    "立秋": "08-07", "处暑": "08-23", "白露": "09-07", "秋分": "09-22",
    "寒露": "10-08", "霜降": "10-23", "立冬": "11-07", "小雪": "11-22",
    "大雪": "12-07", "冬至": "12-21", "小寒": "01-05", "大寒": "01-20"
}

The returned value explicitly acknowledges that precise time is unavailable:

python
for term, term_date in SOLAR_TERMS.items():
    if term_date == month_day:
        return {
            "name": term,
            "date": date_str,
            "approx_time": "Precise time requires astronomical calculation"
        }

Almanac results are constant placeholder data for every date:

python
def get_fortune(self, date_str: str) -> Dict[str, list]:
    """Get almanac recommendations (simplified version)."""
    # The actual implementation requires a complex almanac algorithm.
    # This returns sample data.
    return {
        "suitable": ["祭祀", "祈福", "求嗣", "开光", "出行"],
        "avoid": ["嫁娶", "安葬", "破土", "开市", "动土"]
    }

The annual solar-term result is also marked as approximate:

python
return {
    "year": year,
    "solar_terms": terms,
    "note": "These are approximate dates; precise times require astronomical calculation"
}

Technical Analysis

The Skill description cla ...[truncated 1649 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all claims of second-level precision until a validated astronomical implementation exists.
  2. Replace the fixed solar-term table with a reviewed, year-aware, time-zone-aware astronomical algorithm or authoritative dataset.
  3. Remove get_fortune() placeholder output or clearly label it as non-authoritative demonstration data.
  4. Implement date-specific almanac logic backed by a documented and testable ruleset before exposing the feature.
  5. Add tests across multiple years, time zones, leap months, and known solar-term transition timestamps.
  6. Ensure the Skill template communicates uncertainty or unavailable fields instead of forcing fabricated precision.
  7. Update SKILL.md, README files, release notes, and validation claims so they accurately describe implemented behavior.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (117)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This file defines a full community posting and outreach workflow that is unrelated to the skill's declared purpose of lunar calendar querying. That mismatch is dangerous because an agent invoking this skill could be induced to perform external promotional actions, create posts, and engage with third-party platforms beyond user expectations and beyond the least-privilege scope of the tool.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This finding is the concrete dangerous parameter form of the uninstall command: rm -rf /root/.openclaw/workspace/skills/lunar-calendar. In the context of an agent skill install guide, embedding destructive filesystem operations in copy-pasteable form is risky because users may run them under root-owned paths and lose data if the path is wrong or the workspace layout changes.

Content

Scanner excerpt · GITHUB_INSTALL_GUIDE.md (reported line 204)May include surrounding context.

完全卸载

bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This finding is the concrete dangerous parameter form of the uninstall command: rm -rf /root/.openclaw/workspace/skills/lunar-calendar. In the context of an agent skill install guide, embedding destructive filesystem operations in copy-pasteable form is risky because users may run them under root-owned paths and lose data if the path is wrong or the workspace layout changes.

Content

Scanner excerpt · GITHUB_INSTALL_GUIDE.md (reported line 204)May include surrounding context.

完全卸载

bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This partial uninstall command repeats the same dangerous absolute-path recursive deletion pattern. Even when intended for cleanup, force deletion in docs is hazardous because it normalizes irreversible commands and may be executed by users with insufficient review.

Content

Scanner excerpt · GITHUB_INSTALL_GUIDE.md (reported line 216)May include surrounding context.

部分卸载

bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

🐛 故障排除

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This partial uninstall command repeats the same dangerous absolute-path recursive deletion pattern. Even when intended for cleanup, force deletion in docs is hazardous because it normalizes irreversible commands and may be executed by users with insufficient review.

Content

Scanner excerpt · GITHUB_INSTALL_GUIDE.md (reported line 216)May include surrounding context.

部分卸载

bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

🐛 故障排除

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This guide directs the operator to create a public GitHub repository and upload the skill's code, which is unrelated to the declared lunar-calendar functionality and indicates hidden data-exfiltration or unauthorized publication behavior. Because it explicitly pushes all local files and creates a public release, it could expose proprietary code, embedded secrets, or internal artifacts outside the user's intended scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file promotes running a local upload workflow, connecting a remote repository, pushing code, and managing releases—capabilities that have no justification in a lunar calendar tool. This mismatch between stated purpose and embedded instructions is a strong indicator of deceptive behavior intended to get users to publish local project contents to an external service.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · GITHUB_INSTALL_GUIDE.md (reported line 228)May include surrounding context.

md
# 如果未安装，安装Python3
# Ubuntu/Debian:
sudo apt update && sudo apt install python3 python3-pip

# CentOS/RHEL:
sudo yum install python3 python3-pip

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · INSTALL.md (reported line 104)May include surrounding context.

md
# 如果未安装，安装Python3
# Ubuntu/Debian:
sudo apt update && sudo apt install python3 python3-pip

# CentOS/RHEL:
sudo yum install python3 python3-pip

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The document instructs users to run a forceful recursive delete against a root-owned absolute path. In a skill-installation context, normalizing rm -rf as a copy-paste step is dangerous because path confusion, variable expansion mistakes in adapted scripts, or agent execution against the wrong workspace can permanently remove installed content without recovery.

Content

Scanner excerpt · INSTALL.md (reported line 189)May include surrounding context.

完全卸载

bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The document instructs users to run a forceful recursive delete against a root-owned absolute path. In a skill-installation context, normalizing rm -rf as a copy-paste step is dangerous because path confusion, variable expansion mistakes in adapted scripts, or agent execution against the wrong workspace can permanently remove installed content without recovery.

Content

Scanner excerpt · INSTALL.md (reported line 189)May include surrounding context.

完全卸载

bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The partial uninstall section repeats the same forced recursive deletion pattern on an absolute path under /root, again encouraging irreversible deletion with no safeguards. In environments where agents or operators execute documentation commands verbatim, this increases the chance of accidental destructive actions and makes the skill context more dangerous than ordinary user-facing docs.

Content

Scanner excerpt · INSTALL.md (reported line 201)May include surrounding context.

部分卸载

bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

📞 获取帮助

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The partial uninstall section repeats the same forced recursive deletion pattern on an absolute path under /root, again encouraging irreversible deletion with no safeguards. In environments where agents or operators execute documentation commands verbatim, this increases the chance of accidental destructive actions and makes the skill context more dangerous than ordinary user-facing docs.

Content

Scanner excerpt · INSTALL.md (reported line 201)May include surrounding context.

部分卸载

bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

📞 获取帮助

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This script performs repository initialization, global Git configuration, commits, tagging, and archive creation, which are unrelated to the declared lunar calendar query functionality. In a skill expected to answer calendar/almanac questions, bundling release-management actions is dangerous because activating or reviewing the skill could lead to unexpected modification of the user's environment and source tree.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file contains capabilities for repository setup, version tagging, and packaging that are unjustified for a lunar calendar lookup tool. This mismatch increases the risk of deceptive or accidental execution of privileged local actions, especially because users would not expect a date-conversion skill to alter Git state, create commits, or package files.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script requires a GitHub token and uses it for authenticated API and git operations that have no legitimate connection to lunar calendar functionality. This creates a direct credential abuse path and can lead to unauthorized repository creation, code publication, and possible token exposure through command usage or remote configuration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script creates a GitHub repository and publishes local code, which is unrelated to a lunar calendar query skill and indicates hidden supply-chain or exfiltration behavior. In this skill context, outbound repo creation and code publication are especially suspicious because they can transfer project contents to an attacker-controlled or unintended public destination.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
GITHUB_INSTALL_GUIDE.md:204

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
INSTALL.md:189