ClawHub
Back to skill

Security audit

Aistro

Security checks across malware telemetry and agentic risk

Overview

Aistro is a disclosed astrology skill that uses birth details and local calculation scripts for its stated reports, with privacy and dependency-use cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable sharing birth date, time, and place details in the chat and allowing the skill to run local Node scripts with npm dependencies. Do not provide another person's birth details unless you have their permission or a legitimate reason.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill hard-codes Chinese-language prompt patterns and tone instructions for report generation without indicating any fallback to the user's preferred language. This can cause unintended language switching, reduce user comprehension, and increase the chance that users misunderstand sensitive personalized content or cannot effectively review generated output.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly requires collecting a second person's birth date, time, and place, which are sensitive personal data elements, but it provides no user-facing notice, consent check, or guidance on obtaining that person's permission. This creates a privacy risk because users may submit another person's personal data without authorization, and the skill normalizes processing third-party data without safeguards.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The report format instructs the system to display both users' detailed chart placements, which can reveal inferred personal attributes derived from birth data, without any disclosure that this information will be shown back in the output. In context, this increases the chance of overexposing a third party's personal information and sensitive inferences to someone who may not have that person's consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.