AsianSeeker - Openclaw FortuneTeller

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:14 AM UTC
• Version: 1.0.2

Overview

This is a disclosed horoscope automation skill, but it needs Review because it stores personal profile data, creates recurring Telegram delivery, and uses stored values in scheduled command strings without clear validation.

Before installing, confirm you are comfortable storing birth details, location/timezone, derived horoscope profile data, and a Telegram chat ID locally, and with automated messages being sent through Telegram. Use a pinned dependency or isolated virtual environment for kerykeion, protect AstronomyAPI credentials, validate stored latitude/longitude/timezone values, and verify the Telegram destination before enabling the cron job.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:124

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/horoscope-prompt-template.md:7

Finding

Memory-Derived Values Are Interpolated into Agent-Executed Shell Commands

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is a clear description-behavior mismatch. While Ba-Zi/Four Pillars is part of the declared scope, this code chunk only implements that portion plus a basic Western zodiac sun-sign lookup. The primary declared purpose emphasizes a broad multi-system horoscope service with external astrology tooling/API usage and Telegram delivery, but none of those capabilities appear here. The code has no network access, no messaging integration, no numerology or I Ching logic, and no natal-chart/transit computation. Therefore the supplied code represents only a narrow subset of the declared functionality and materially differs from the advertised skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad, multi-system horoscope skill with external astrology services and Telegram delivery. The supplied code does only numerology calculations using Python standard library and local date arithmetic, exposed through a command-line --date argument and JSON output. While numerology is one declared component, the primary described scope is much broader, and this chunk lacks the other major declared systems and delivery/integration behaviors. There are no suspicious undeclared capabilities beyond numerology computation, but the code materially underimplements the declared purpose, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad multi-system daily horoscope skill with multiple divination systems, external astronomy API usage, and Telegram delivery. The supplied code only implements one narrow component: Western natal chart calculation via kerykeion. It computes natal placements, houses, and aspects from birth data and prints JSON locally. There is no evidence of Ba-Zi, numerology, I Ching, transit/daily horoscope generation, astronomyapi.com integration, or Telegram messaging in this chunk. This is a material scope difference, so the description does not accurately represent the code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad multi-system horoscope skill, but this code chunk implements a much narrower function: retrieving astronomical body positions from astronomyapi.com and converting them into simple Western transit-style output. It does not calculate natal charts, does not perform Ba-Zi, numerology, or I Ching analysis, and does not send anything to Telegram. While use of astronomyapi.com aligns with part of the description, the actual behavior in this chunk is substantially narrower than the declared purpose, so this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes capabilities that access environment variables, local files, network APIs, cron scheduling, and Telegram delivery, but it does not declare an explicit permission or allowed-tools scope. That creates an over-privilege and transparency problem: reviewers and runtimes cannot easily constrain what the skill is allowed to access, increasing the blast radius if the skill or referenced scripts are modified or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs storing birth date/time, location, timezone, LifePath number, Telegram chat ID, and schedule data in local memory/state files, but it does not clearly warn about this sensitive data handling or retention. This is dangerous because users may disclose highly personal profile data without informed consent, and local plaintext storage increases the chance of unauthorized access, secondary use, or accidental leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill asks for a Telegram chat ID and later configures automated delivery to that identifier, but it does not clearly warn users that generated content will be sent through Telegram on a schedule. That omission matters because chat IDs are sensitive routing identifiers and automated third-party delivery creates privacy, consent, and misdelivery risks if the wrong ID is entered or reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template instructs the agent to send a personalized horoscope to a Telegram chat ID derived from memory, which implies external transmission of user-linked personal data. Even if the content seems low sensitivity, it includes identity and inferred profile data, and the prompt provides no consent check, notice, destination verification, or data-minimization guard before exfiltrating it to a third-party messaging platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch-planetary-positions.py (reported line 17)May include surrounding context.

python

from urllib.request import urlopen, Request
from urllib.error import URLError

API_BASE = "https://api.astronomyapi.com/api/v2"
SIGNS = [
    "Aries", "Taurus", "Gemini", "Cancer", "Leo", "Virgo",
    "Libra", "Scorpio", "Sagittarius", "Capricorn", "Aquarius", "Pisces",

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown file documents Basic Auth using an application secret and explicitly names environment variables for credentials, but it does not include any caution about protecting secrets or avoiding exposure in logs or shared environments. Because markdown files should warn about behaviors affecting privacy or system integrity, this omission is a minor safety disclosure gap.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction forces a specific bilingual output format regardless of user preference. That creates a language/locale policy concern because the skill does not offer a language choice or explain why this fixed locale behavior is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file presents multiple sections with Chinese characters and Vietnamese labels as part of the content, but it does not explain that multilingual terminology will be used or offer a language preference choice. Under the natural-language policy criteria, forcing specific languages or locales without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code requires personal birth information via command-line arguments and outputs a derived profile, but there is no visible warning, prompt, or disclosure about handling potentially sensitive personal data. For code files, SQP-2 applies when user-affecting data handling lacks any form of user disclosure, and this script provides none beyond the bare parameter names.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/calculate-western-natal-chart-using-kerykeion.py (reported line 126)May include surrounding context.

python

)

        # House cusps from named attributes
        cusps = [round(getattr(subject, h).abs_pos, 2) for h in HOUSE_ATTRS]

        # Planets
        planet_names = ["sun", "moon", "mercury", "venus", "mars",

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/calculate-western-natal-chart-using-kerykeion.py (reported line 133)May include surrounding context.

python

"jupiter", "saturn", "uranus", "neptune", "pluto"]
        bodies = {}
        for pname in planet_names:
            obj = getattr(subject, pname)
            bodies[pname.capitalize()] = get_planet_data(obj)

        # Lunar node (v5 API)

Static analysis

No suspicious patterns detected.