ClawHub
Back to skill

Security audit

Financial Astrology

Security checks for vulnerabilities and agentic risk

Overview

This skill is an offline financial astrology tool with speculative trading-language cautions, but I found no hidden data access, persistence, credential use, or trade execution behavior.

Install dependencies in an isolated environment and prefer a pinned, reviewed pyswisseph version. Use explicit timezone, date, latitude, and longitude for any time-sensitive output, and do not rely on astrology-based signals as financial advice or automated trading input.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:42
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` Install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Obtain the hash from a trusted source after independently reviewing the exact wheel or source distribution used by supported platforms. 4. Install dependencies inside an isolated virtual environment rather than a shared or system Python environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Avoid running package installation with administrative privileges. 6. Document the expected package index and consider an organization-controlled, verified dependency mirror. 7. Review new package versions before updating the pin and regenerate hashes only after validating the new artifacts. 8. Update all affected documentation locations so users are not presented with an unsafe alternative command. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation explicitly states the system flow culminates in concrete BUY/SELL recommendations with entry price, stop-loss, and take-profit levels, which goes beyond generic educational content and into actionable financial advice. In the context of an agent skill that may autonomously influence user decisions, this creates compliance, safety, and user-harm risk, especially because the same document frames astrology as an input to trading decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description is broad enough to match general finance, trading, or astrology-related requests without clear activation boundaries. That can cause the skill to be invoked in contexts where users did not explicitly ask for astrology-based analysis, increasing the chance of misleading financial guidance or inappropriate tool routing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill sets JST (Asia/Tokyo, UTC+9) as the default input/output locale and timezone without requiring user confirmation. In a financial/trading context, silent timezone assumptions can shift timestamps, sessions, and planetary calculations, producing materially incorrect analysis or trade timing for users in other regions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. The module docstring and later output strings establish Vietnamese as the default interaction language, but the script does not provide a language/locale selection mechanism or justify that it is intended only for Vietnamese-speaking or Japan-specific users.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/hora_service.py (reported line 145)May include surrounding context.

python
# If before sunrise, use previous day's lord.
    if jd_now < sunrise_jd:
        # Before sunrise → still yesterday's Vedic day
        yesterday = dt.replace(day=dt.day) - __import__('datetime').timedelta(days=1)
        day_of_week_idx = yesterday.weekday()
    else:
        day_of_week_idx = dt.weekday()

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

Early documentation frames the skill as short-term financial astrology for day trading and says it is not for broader uses, but later sections document a --natal mode and Dasha analysis for personal life prediction. This expands the documented behavior beyond the originally stated trading-focused purpose and creates internal intent inconsistency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains a natural-language locale constraint: 'Language: Tiếng Việt'. Under the policy, forcing a specific language without explicit user opt-in can be a language/locale policy violation unless it is clearly offered as a choice or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README states 'Current time (JST default)' and uses Asia/Tokyo as the default timezone in usage examples and parameter documentation. This is a locale-specific default that can shape outputs for users in other regions, but the documentation does not explain why this locale is required or present it as an explicit opt-in choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This README is written entirely in Vietnamese and relies on a link to an English version rather than presenting a user-facing language choice within the file itself. The policy allows locale constraints when users are given a language/locale choice or when the constraint is clearly justified; here the file does not explicitly offer such opt-in beyond a separate link.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring at L0686 states the function finds Moon combinations by 'same sign hoặc tight aspect', implying two detection modes. However, the implementation only checks whether the Moon and another body are in the same sign at L0696-L0703 and never evaluates aspects or orb tightness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The top-level docstring is written entirely in Vietnamese, while the rest of the code and identifiers are largely English. This creates a natural-language locale constraint for users or maintainers without any explicit opt-in or justification that the skill is intended only for Vietnamese-speaking audiences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring for get_current_hora says "Get current hora for Hekinan, Japan," which implies the function is specific to that location. In reality, the function takes lat, lon, and tz_name parameters and computes hora for any supplied location, so the documentation actively understates and misstates the function's behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.