Lunar Calendar

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:36 PM UTC
• Version: 0.9.0

Overview

The core lunar-calendar skill is understandable, but the package includes unrelated GitHub publishing scripts that can expose code and persist a GitHub token.

Install only if you need the lunar-calendar runtime and are prepared to ignore or remove the bundled publishing scripts and guides. Do not run the GitHub setup scripts, do not provide a GitHub token to this package, and verify any downloaded release archive and dependency versions before installation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: INSTALL.md:6
• Finding: Unverified Remote Payload Retrieval and Execution## Vulnerability Details **File Location**: `INSTALL.md:6-13`, `INSTALL.md:113-116`, `INSTALL.md:174-181`; equivalent instructions also appear in `GITHUB_INSTALL_GUIDE.md:42` and `GITHUB_INSTALL_GUIDE.md:191` **Vulnerability Type**: Remote payload retrieval and execution without integrity verification **Risk Level**: High ### Vulnerable Code ```bash # 1. Download the release archive wget https://github.com/xiamuciqing/lunar-birthday-reminder/releases/download/v0.9.0/lunar-birthday-reminder-v0.9.0.tar.gz # 2. Extract it tar -xzf lunar-birthday-reminder-v0.9.0.tar.gz cd lunar-birthday-reminder # 3. Run the installation script ./install.sh ``` The troubleshooting instructions also recommend downloading and executing another remote script: ```bash # Install pip curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py python3 get-pip.py ``` The upgrade procedure repeats the unverified release installation pattern: ```bash cd /tmp wget https://github.com/xiamuciqing/lunar-birthday-reminder/releases/download/v1.0.0/lunar-birthday-reminder-v1.0.0.tar.gz tar -xzf lunar-birthday-reminder-v1.0.0.tar.gz # Install the new version cd lunar-birthday-reminder ./install.sh ``` ### Technical Analysis The recommended installation and upgrade procedures download archives from a personal GitHub repository, extract their contents, and execute the included `install.sh` without checking a cryptographic hash or digital signature. The reviewed local repository indicates what its generated installer is intended to do, but it cannot guarantee that a remotely hosted release asset will always contain the same content. A release asset can effectively change after review if the hosting account is compromised or an asset is deleted and replaced. The `get-pip.py` procedure similarly downloads a Python program and executes it without integrity validation. These remote execution steps are not necessary for the Skill's norm ...[truncated 1227 chars]
• Remediation: ## Remediation Suggestions 1. Publish a SHA-256 or stronger digest for every release artifact through an independently protected channel. 2. Require verification before extraction: ```bash echo "<expected-sha256> lunar-birthday-reminder-v0.9.0.tar.gz" | sha256sum --check ``` 3. Sign release tags and artifacts with Sigstore, GPG, or another verifiable release-signing mechanism. 4. Pin installation instructions to a reviewed commit or immutable artifact digest. 5. Replace the `get-pip.py` procedure with the operating system's package manager or Python's supported environment-management process. 6. Instruct users to inspect `install.sh` before execution and install as an unprivileged user. 7. Use a dedicated virtual environment rather than modifying a system-wide Python installation. 8. Add the same integrity controls to both `INSTALL.md` and `GITHUB_INSTALL_GUIDE.md`.

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:120
• Finding: Unpinned Python Dependencies Allow Supply-Chain Drift## Vulnerability Details **File Location**: `INSTALL.md:120-124`, `scripts/publish.sh:169-184`, `package.json:23-26` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code The installation guide retrieves whichever package versions are current at installation time: ```bash # Use a third-party mirror pip install lunardate cnlunar -i https://pypi.tuna.tsinghua.edu.cn/simple ``` The generated release installer also installs dependencies without version or hash constraints: ```bash if python3 -c "import lunardate" > /dev/null; then echo "✅ lunardate is installed" else echo "Installing lunardate..." python3 -m pip install lunardate || echo "Warning: lunardate installation failed" fi if python3 -c "import cnlunar" > /dev/null; then echo "✅ cnlunar is installed" else echo "Installing cnlunar..." python3 -m pip install cnlunar || echo "Warning: cnlunar installation failed" fi ``` Package metadata allows dependency version drift: ```json "dependencies": { "lunardate": "^0.2.0", "cnlunar": "^2.3.0" } ``` ### Technical Analysis Dependency names are specified without exact Python package versions or cryptographic hashes. Consequently, two installations of the same Skill version may execute different third-party code. The alternate pip command uses a third-party package index mirror, increasing the number of infrastructure components that must be trusted. Although the package names do not appear to be typographical imitations, unpinned resolution leaves users exposed to compromised maintainer accounts, malicious future releases, mirror compromise, and incompatible updates. The generated installer imports each package only to determine whether it is already installed. Importing a compromised Python package can itself execute arbitrary module initialization code. ### Attack Path 1. An attacker comprom ...[truncated 923 chars]
• Remediation: ## Remediation Suggestions 1. Create a locked requirements file containing exact versions: ```text lunardate==<reviewed-version> cnlunar==<reviewed-version> ``` 2. Generate and enforce hashes with a tool such as `pip-compile --generate-hashes`. 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Review and test every dependency update before changing the lock file. 5. Use the canonical package index unless a specifically trusted mirror is operationally required. 6. Install dependencies inside a dedicated virtual environment under an unprivileged account. 7. Align `package.json`, documentation, and the generated installer around one reviewed dependency lock source.

T09 · Insecure Skill Coding Practices

Error

• Location: github_auto_setup.sh:5
• Finding: GitHub Access Token Is Persisted in the Git Remote URL## Vulnerability Details **File Location**: `github_auto_setup.sh:5-27`; duplicated by the generated script in `scripts/create_github_repo.sh:131-154` **Vulnerability Type**: Plaintext credential exposure and unsafe credential storage **Risk Level**: High ### Vulnerable Code ```bash if [ -z "$GITHUB_TOKEN" ]; then echo "Please set the GITHUB_TOKEN environment variable" exit 1 fi # Create repository curl -X POST \ -H "Authorization: token $GITHUB_TOKEN" \ -H "Accept: application/vnd.github.v3+json" \ https://api.github.com/user/repos \ -d '{ "name": "lunar-birthday-reminder", "description": "Lunar birthday reminder system", "private": false }' # Initialize local repository git init git add . git commit -m "Initial release" git branch -M main git remote add origin https://$[e-mail]/xiamuciqing/lunar-birthday-reminder.git git push -u origin main ``` ### Technical Analysis The script embeds `GITHUB_TOKEN` directly in the Git remote URL. Git stores remote URLs in `.git/config`, so the credential persists after the script terminates. It can subsequently be exposed through: - Direct access to `.git/config`. - `git remote -v` and diagnostic output. - Backups or support archives containing `.git`. - Other local processes with access to the repository. - Accidental copying or publication of repository metadata. - Command-line and process inspection while Git is running. The token is also supplied as a curl command-line header. On systems where process arguments are visible to other users, it may be transiently observable. GitHub repository creation and publication are not part of the Skill's declared lunar-calendar runtime functionality. Therefore, requiring a GitHub token for these bundled utilities exceeds the minimum privileges needed for normal Skill operation. ### Attack Path 1. A user exports a GitHub token and runs `github_auto_setup ...[truncated 923 chars]
• Remediation: ## Remediation Suggestions 1. Never place tokens in Git remote URLs. Configure a credential-free URL: ```bash git remote add origin https://github.com/xiamuciqing/lunar-birthday-reminder.git ``` 2. Authenticate through Git Credential Manager, `gh auth`, a protected credential helper, or a narrowly scoped askpass mechanism. 3. Prefer short-lived, fine-grained tokens limited to the required repository and operations. 4. Avoid passing credentials directly in process arguments where feasible. 5. Remove credentials from existing remote configurations: ```bash git remote set-url origin https://github.com/xiamuciqing/lunar-birthday-reminder.git ``` 6. Rotate every token that has been used with the current script. 7. Separate publication utilities from the runtime Skill package because they are unnecessary for calendar queries. 8. Add automated secret scanning for Git configuration, generated files, logs, and release archives.

other

Warning

• Location: scripts/lunar_calculator.py:45
• Finding: Precision and Almanac Claims Conflict with Placeholder Implementation## Vulnerability Details **File Location**: `scripts/lunar_calculator.py:45-52`, `scripts/lunar_calculator.py:105-124`, `scripts/lunar_calculator.py:179-193`; conflicting claims appear in `SKILL.md:15-20` and `SKILL.md:70-90` **Vulnerability Type**: Output integrity and accuracy misrepresentation **Risk Level**: Medium ### Vulnerable Code Solar terms are represented as fixed month-and-day values: ```python # Solar-term data (simplified; precise calculation is still required) SOLAR_TERMS = { "立春": "02-03", "雨水": "02-18", "惊蛰": "03-05", "春分": "03-20", "清明": "04-04", "谷雨": "04-19", "立夏": "05-05", "小满": "05-20", "芒种": "06-05", "夏至": "06-21", "小暑": "07-07", "大暑": "07-22", "立秋": "08-07", "处暑": "08-23", "白露": "09-07", "秋分": "09-22", "寒露": "10-08", "霜降": "10-23", "立冬": "11-07", "小雪": "11-22", "大雪": "12-07", "冬至": "12-21", "小寒": "01-05", "大寒": "01-20" } ``` The returned value explicitly acknowledges that precise time is unavailable: ```python for term, term_date in SOLAR_TERMS.items(): if term_date == month_day: return { "name": term, "date": date_str, "approx_time": "Precise time requires astronomical calculation" } ``` Almanac results are constant placeholder data for every date: ```python def get_fortune(self, date_str: str) -> Dict[str, list]: """Get almanac recommendations (simplified version).""" # The actual implementation requires a complex almanac algorithm. # This returns sample data. return { "suitable": ["祭祀", "祈福", "求嗣", "开光", "出行"], "avoid": ["嫁娶", "安葬", "破土", "开市", "动土"] } ``` The annual solar-term result is also marked as approximate: ```python return { "year": year, "solar_terms": terms, "note": "These are approximate dates; precise times require astronomical calculation" } ``` ### Technical Analysis The Skill description cla ...[truncated 1649 chars]
• Remediation: ## Remediation Suggestions 1. Remove all claims of second-level precision until a validated astronomical implementation exists. 2. Replace the fixed solar-term table with a reviewed, year-aware, time-zone-aware astronomical algorithm or authoritative dataset. 3. Remove `get_fortune()` placeholder output or clearly label it as non-authoritative demonstration data. 4. Implement date-specific almanac logic backed by a documented and testable ruleset before exposing the feature. 5. Add tests across multiple years, time zones, leap months, and known solar-term transition timestamps. 6. Ensure the Skill template communicates uncertainty or unavailable fields instead of forcing fabricated precision. 7. Update `SKILL.md`, README files, release notes, and validation claims so they accurately describe implemented behavior.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (117)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file defines a full community posting and outreach workflow that is unrelated to the skill's declared purpose of lunar calendar querying. That mismatch is dangerous because an agent invoking this skill could be induced to perform external promotional actions, create posts, and engage with third-party platforms beyond user expectations and beyond the least-privilege scope of the tool.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 完全卸载
```bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

• Confidence: 98% confidence
• Finding: This finding is the concrete dangerous parameter form of the uninstall command: rm -rf /root/.openclaw/workspace/skills/lunar-calendar. In the context of an agent skill install guide, embedding destructive filesystem operations in copy-pasteable form is risky because users may run them under root-owned paths and lose data if the path is wrong or the workspace layout changes.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 完全卸载
```bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

• Confidence: 98% confidence
• Finding: This finding is the concrete dangerous parameter form of the uninstall command: rm -rf /root/.openclaw/workspace/skills/lunar-calendar. In the context of an agent skill install guide, embedding destructive filesystem operations in copy-pasteable form is risky because users may run them under root-owned paths and lose data if the path is wrong or the workspace layout changes.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 部分卸载
```bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar
```

## 🐛 故障排除

• Confidence: 98% confidence
• Finding: This partial uninstall command repeats the same dangerous absolute-path recursive deletion pattern. Even when intended for cleanup, force deletion in docs is hazardous because it normalizes irreversible commands and may be executed by users with insufficient review.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 部分卸载
```bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar
```

## 🐛 故障排除

• Confidence: 98% confidence
• Finding: This partial uninstall command repeats the same dangerous absolute-path recursive deletion pattern. Even when intended for cleanup, force deletion in docs is hazardous because it normalizes irreversible commands and may be executed by users with insufficient review.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This guide directs the operator to create a public GitHub repository and upload the skill's code, which is unrelated to the declared lunar-calendar functionality and indicates hidden data-exfiltration or unauthorized publication behavior. Because it explicitly pushes all local files and creates a public release, it could expose proprietary code, embedded secrets, or internal artifacts outside the user's intended scope.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file promotes running a local upload workflow, connecting a remote repository, pushing code, and managing releases—capabilities that have no justification in a lunar calendar tool. This mismatch between stated purpose and embedded instructions is a strong indicator of deceptive behavior intended to get users to publish local project contents to an external service.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 如果未安装，安装Python3
# Ubuntu/Debian:
sudo apt update && sudo apt install python3 python3-pip

# CentOS/RHEL:
sudo yum install python3 python3-pip

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 如果未安装，安装Python3
# Ubuntu/Debian:
sudo apt update && sudo apt install python3 python3-pip

# CentOS/RHEL:
sudo yum install python3 python3-pip

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 完全卸载
```bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

• Confidence: 90% confidence
• Finding: The document instructs users to run a forceful recursive delete against a root-owned absolute path. In a skill-installation context, normalizing `rm -rf` as a copy-paste step is dangerous because path confusion, variable expansion mistakes in adapted scripts, or agent execution against the wrong workspace can permanently remove installed content without recovery.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 完全卸载
```bash
# 1. 删除技能目录
rm -rf /root/.openclaw/workspace/skills/lunar-calendar

# 2. 卸载Python包（可选）
pip uninstall lunardate cnlunar -y

• Confidence: 90% confidence
• Finding: The document instructs users to run a forceful recursive delete against a root-owned absolute path. In a skill-installation context, normalizing `rm -rf` as a copy-paste step is dangerous because path confusion, variable expansion mistakes in adapted scripts, or agent execution against the wrong workspace can permanently remove installed content without recovery.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 部分卸载
```bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar
```

## 📞 获取帮助

• Confidence: 90% confidence
• Finding: The partial uninstall section repeats the same forced recursive deletion pattern on an absolute path under `/root`, again encouraging irreversible deletion with no safeguards. In environments where agents or operators execute documentation commands verbatim, this increases the chance of accidental destructive actions and makes the skill context more dangerous than ordinary user-facing docs.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 部分卸载
```bash
# 只删除技能，保留Python包
rm -rf /root/.openclaw/workspace/skills/lunar-calendar
```

## 📞 获取帮助

• Confidence: 90% confidence
• Finding: The partial uninstall section repeats the same forced recursive deletion pattern on an absolute path under `/root`, again encouraging irreversible deletion with no safeguards. In environments where agents or operators execute documentation commands verbatim, this increases the chance of accidental destructive actions and makes the skill context more dangerous than ordinary user-facing docs.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This script performs repository initialization, global Git configuration, commits, tagging, and archive creation, which are unrelated to the declared lunar calendar query functionality. In a skill expected to answer calendar/almanac questions, bundling release-management actions is dangerous because activating or reviewing the skill could lead to unexpected modification of the user's environment and source tree.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file contains capabilities for repository setup, version tagging, and packaging that are unjustified for a lunar calendar lookup tool. This mismatch increases the risk of deceptive or accidental execution of privileged local actions, especially because users would not expect a date-conversion skill to alter Git state, create commits, or package files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: A skill presented as a user-facing lunar calendar utility but actually centered on testing, validation, report generation, or packaging has a substantial transparency failure. In agent workflows, hidden non-user-facing behaviors can consume resources, create artifacts, and make downstream automation trust outputs or side effects that were never intended by the caller.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script requires a GitHub token and uses it for authenticated API and git operations that have no legitimate connection to lunar calendar functionality. This creates a direct credential abuse path and can lead to unauthorized repository creation, code publication, and possible token exposure through command usage or remote configuration.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script creates a GitHub repository and publishes local code, which is unrelated to a lunar calendar query skill and indicates hidden supply-chain or exfiltration behavior. In this skill context, outbound repo creation and code publication are especially suspicious because they can transfer project contents to an attacker-controlled or unintended public destination.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: GITHUB_INSTALL_GUIDE.md:204

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: INSTALL.md:189