Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Chinese divination instruction skill with off-platform promotional contact information, but it has no code, data access, persistence, or privileged behavior.
Install only if you are comfortable with a Chinese-language divination prompt. Avoid sharing sensitive personal, financial, or legal details in divination questions, and treat the WeChat contact and external marketplace link as off-platform promotion outside ClawHub safeguards.
The example trigger phrase is broad enough that ordinary user conversation about emotions or recent relationships could unintentionally activate or invoke the skill. In an agent ecosystem, this can cause unexpected handling of sensitive personal topics, misrouting of user intent, or silent invocation of a divination workflow when the user did not explicitly request it.
The skill’s user-facing instructions and examples are entirely in Chinese, and there is no indication that language choice is optional or that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in can be a natural-language policy concern.
The skill documentation includes unrelated contact details, WeChat promotion, and marketing for other tools that are not necessary for a divination skill to function. This creates a trust and social-engineering risk by encouraging users to leave the platform and contact the author through external channels, where phishing, data harvesting, or off-platform monetization could occur without platform safeguards.
No suspicious patterns detected.
