ClawHub
Back to skill

Security audit

Bazi Chart - 八字排盘

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do the advertised Bazi chart calculation, but it sends the birth-chart details you provide to JisuAPI using your API key.

Install only if you are comfortable sharing the entered birth-chart details with JisuAPI and letting the skill use your JISU_API_KEY. Use a dedicated or easily rotated API key, monitor quota usage, and avoid entering a real name when a nickname or blank value will work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger description includes broad language such as '或类似八字排盘时', which can cause the skill to activate on loosely related user requests. Over-broad activation is risky here because the skill handles sensitive personal data and may send it to an external API without sufficiently explicit user intent.

Missing User Warnings

High
Confidence
98% confidence
Finding
The documentation states that name, city, and exact birth date/time are sent verbatim to a third-party API, but it does not provide a clear privacy warning, consent flow, or data-minimization guidance. These fields constitute sensitive personal data, and external transmission can expose users to privacy loss, profiling, or retention by the API provider.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill sends highly sensitive personal data—including name, city, birth date/time, and sex—to a third-party API without any user-facing disclosure, consent flow, or data-minimization controls. Even if the transport is HTTPS, this exposes private profile data to an external service and may create compliance, retention, and privacy risks outside the user's expectations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.