星座配对 - 即刻数据

• Analyzed: May 9, 2026, 2:51 AM
• Findings: 0
• Version: 1.0.0
• Hash: 1b5687c3dd9c187763075ad6e195d40aee949b1b44cec38046153693df4311a9
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: jike-zodiac-pairing-query Version: 1.0.0 The skill is a straightforward API wrapper for querying zodiac pairing information from jikeapi.cn. The Python script (zodiac_pairing_query.py) uses standard libraries to handle arguments and perform network requests, with no evidence of malicious behavior, data exfiltration, or command injection vulnerabilities.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

Your Jike API key and the entered zodiac values are sent to the configured API endpoint; if JIKE_API_BASE_URL is unexpectedly set, they could be sent somewhere other than the default Jike API host.

Why it was flagged

The helper reads a Jike AppKey and sends it as a request parameter to the configured API endpoint; this is expected for the service, but the endpoint can be changed by an environment variable.

Skill content

API_BASE_URL = os.environ.get("JIKE_API_BASE_URL", "https://api.jikeapi.cn").rstrip("/") ... urllib.parse.urlencode({**params, 'appkey': appkey})

Recommendation

Use a dedicated Jike API key, avoid passing secrets with --key on shared machines, and verify JIKE_API_BASE_URL is unset or points to the intended Jike API endpoint.