ClawHub
Back to skill

Security audit

Rokusei

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local astrology calculator that uses a birthday to generate Rokusei results and does not show hidden data access or unsafe behavior.

Install if you are comfortable with an entertainment astrology skill that uses birth dates and may activate on broad birthday-fortune or Japanese-astrology prompts. Treat outputs as entertainment, not professional advice, and review the external npm dependency before use in stricter environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The activation condition is broad enough to trigger on generic birthday-based personality or fortune requests, which can cause the skill to intercept prompts not specifically intended for Rokusei. In an agent environment, this can lead to misrouting, unexpected collection/use of birth-date data, and delivery of astrology-specific guidance where the user may have intended a different domain or a more general assistant response.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad phrases like 'Japanese astrology' and 'star type astrology' that can overlap with many unrelated requests, increasing the chance of accidental invocation. This is dangerous in context because the skill processes sensitive personal data (birth date) and may steer conversations into deterministic personality/fortune outputs without clear user intent to use this specific system.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.