ClawHub
Back to skill

Security audit

Astrology Foreteller

Security checks for vulnerabilities and agentic risk

Overview

This is a low-impact zodiac and tarot entertainment skill with no evidence of data theft or persistence, but its documentation overstates the implementation and its install/runtime hygiene needs caution.

Install only if you are comfortable with a Chinese-language entertainment skill that runs local Python helper scripts. Treat zodiac and tarot outputs as entertainment, not medical, financial, relationship, or investment advice. Prefer a pinned installer version over @latest, and review future updates because the package describes itself as a placeholder intended to be replaced by a later version.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:29
Finding

Mutable, Unpinned Package Execution in Installation Instructions

Content
View full analysis
Remediation
View remediation
install zodiac-tarot-master ``` 2. Publish and verify an integrity digest or signed release when the package ecosystem supports it. 3. Use a lockfile or equivalent immutable dependency record for automated installation workflows. 4. Document the expected registry and trusted publisher identity. 5. Review the pinned package and its transitive dependencies before updating the documented version. 6. Avoid running the installer with administrator or root privileges. ]]>

T07 · Tool Hijacking and Spoofing

Warning
Location
trigger.py:57
Finding

Subprocess Execution Relies on Untrusted PATH and Working-Directory Resolution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

描述与代码存在明显不一致。代码确实覆盖了“星座配对”这一部分，但没有任何“塔罗牌占卜”实现，因此声明比实际功能更宽，且会让用户误以为该技能支持塔罗相关能力。另外，声明称其为占位版本、待2.0更新，而提供的代码并非空占位，而是一个实际可执行的星座配对脚本。未发现越权访问、额外敏感资源使用或隐藏触发器，但在功能层面仍属于实质性描述不符。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

代码的核心功能与声明部分重合在“塔罗牌占卜”上，且确实像简化/占位实现，因为牌库明显不完整。但声明明确写有“星座配对 + 塔罗牌占卜”，而提供的代码完全没有星座、星盘、配对逻辑、生日输入或匹配计算，因此存在实质性描述不符。未发现越权访问、网络、文件操作或其他隐藏能力；主要问题是声明的双功能中只实现了其中一部分。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

描述称这是一个“占位版本，待2.0版本更新”，意味着当前应主要是占位或未完整实现。但代码并非仅占位：它包含完整的触发逻辑、关键词识别、参数提取、帮助输出，并实际调用兼容性和塔罗脚本处理请求。因此，声明对当前实现状态存在明显弱化/失真。虽然代码的总体主题仍与星座配对和塔罗占卜一致，没有发现越界的数据访问或明显恶意行为，但“占位版本”的描述与实际可执行行为不符，属于描述与行为不一致。

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README instructs users to run npx clawhub@latest install zodiac-tarot-master, which pulls and executes the latest published package version rather than a pinned, reviewed release. If the upstream package is compromised or a malicious version is published later, users could execute untrusted code during installation. The fact that this is only a placeholder skill does not reduce the supply-chain risk, because the dangerous step is the install command itself.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The phrase "女性友好的设计" indicates the skill is designed specifically around a gendered audience. This can be a natural-language policy concern because it imposes a demographic framing without offering users a choice or explaining a justified need for that constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file explicitly presents tarot/divination for health and finance topics without any disclaimer that outputs are for entertainment only and must not replace professional medical or financial advice. In this skill context, that can mislead users into acting on unverifiable guidance for high-stakes decisions, increasing the risk of harm even though the content is not overtly malicious.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description states '星座配对 + 塔罗牌占卜占位版本', which suggests the skill covers both zodiac matching and tarot reading, even if placeholder-quality. However, the implemented logic in this file only calculates zodiac compatibility using static zodiac data, element rules, and randomized review text, with no tarot card model, draw, spread, or interpretation behavior present.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

L003-L005 的模块说明明确写明“包含78张塔罗牌（22张大阿卡纳 + 56张小阿卡纳）”，但实际数据在 L015-L090 只定义了少量大阿卡纳牌和一个小阿卡纳 cups 条目。该注释不是单纯省略细节，而是对当前实现范围作出了与代码事实相矛盾的描述。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s docstring, user-facing usage text, and divination output are written exclusively in Chinese, indicating the skill is designed to operate in a single language. Because there is no opt-in, alternative locale support, or stated regional justification, this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes very generic terms such as '星座', '配对', '占卜', and 'tarot/zodiac', which can overlap with ordinary user conversation and cause the skill to activate outside of clear user intent. This increases the chance of unintended routing or prompt interception behavior, especially because the skill covers broad entertainment topics that are commonly mentioned in casual chat.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's natural-language descriptions, trigger examples, and user guidance are entirely in Chinese, and the trigger logic also relies primarily on Chinese keywords. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific audience, which creates a locale policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · trigger.py (reported line 57)May include surrounding context.

python
if zodiac1 and zodiac2:
        # 调用星座配对脚本
        result = subprocess.run(["python", "scripts/compatibility.py", zodiac1, zodiac2], 
                                capture_output=True, text=True)
        return result.stdout
    elif zodiac1 and zodiac2 is None:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · trigger.py (reported line 110)May include surrounding context.

python
if divination_type:
        cmd_args.append(divination_type)
    
    result = subprocess.run(cmd_args, capture_output=True, text=True)
    
    return result.stdout

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README presents the skill name and all user-facing description exclusively in Chinese, with no indication that users can opt into another language or locale. Under the policy rule for natural-language violations, a fixed language choice without user opt-in can be considered a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language content appears to force a specific language/locale for all users. The policy requires either user opt-in for language constraints or clear documentation that the skill is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The content appears to enforce a single language presentation throughout the skill reference material. The policy allows locale constraints only when they are justified or when users are given a language/locale choice, neither of which is stated here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The reference presents zodiac compatibility scoring, personality judgments, and 'historical data and psychology research' framing without any disclaimer that the content is for entertainment rather than reliable guidance. In a relationship-advice style skill, this can mislead users into over-trusting pseudoscientific outputs for meaningful personal decisions, even though the direct security harm is limited.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains natural-language strings and documentation entirely in Chinese, and all CLI prompts/results are presented only in Chinese. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern because users are not offered any locale selection or fallback.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill name, description, tools, and triggers are predominantly Chinese, which suggests the skill is designed around a fixed language experience. There is no indication that users may choose another language or that the Chinese-only scope is explicitly documented as an intentional locale-specific constraint.

Content

No source excerpt is available for this finding.