ClawHub
Back to skill

Security audit

诗诗八字命理分析

Security checks across malware telemetry and agentic risk

Overview

This Bazi fortune-telling skill is purpose-aligned and does not show hidden access or data exfiltration, but it asks users for very identifying personal details.

Install only if you are comfortable entering identifying birth details into the agent chat. Prefer a nickname or initials, skip former-name and historical-event details unless you choose to share them, and treat the output as cultural or entertainment reference rather than medical, financial, or life-planning advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes very broad phrases such as “算命”, “看运势”, and “算一卦”, which can match casual conversation and cause the skill to activate without clear user intent to provide sensitive birth information. In this skill’s context, unintended invocation is more dangerous because the workflow then solicits highly sensitive personal data, increasing privacy and consent risks.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill collects multiple categories of highly sensitive personal data—full name, former names, precise birth date/time, birthplace, gender, and life status—without a clear privacy notice, purpose limitation, retention policy, or consent mechanism. This creates significant privacy and profiling risk, and in this context the data is especially sensitive because precise birth details can be used for identity verification, account recovery workflows, or intrusive personal profiling beyond the stated fortune-telling purpose.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.