ClawHub
Back to skill

Security audit

Compass AI Bazi

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only astrology skill that asks for expected birth details and does not include code execution, storage, credential access, or automatic data transfer.

Installers should be comfortable sharing birth details for an astrology reading. Treat the output as entertainment or cultural interpretation, avoid relying on it for major medical, legal, financial, or life decisions, and review separate privacy terms before using the linked external Compass AI website.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to collect birth date, birth time, gender, and city, which together constitute sensitive personal data and can enable profiling or re-identification. The file provides no privacy notice, retention limits, consent language, or guidance to minimize collection, so users may disclose sensitive data without understanding how it will be handled.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.