48-zodiac-cyber-reader

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill matches its zodiac-reading purpose, but users should know it runs a local Python helper and sends month/day inputs to a declared external API.

This appears safe to use for its stated zodiac-reading purpose if you are comfortable sending month/day birthday inputs to the declared API. Avoid entering birth years, birth times, contact details, addresses, or other unrelated personal data.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

Using the skill can run the included Python script with the date or zodiac ID values supplied in the chat.

Why it was flagged

The tool invokes a local Python helper with user-provided sign/date parameters. This is central to the skill's purpose, but the metadata does not itself show pattern validation for those arguments.

Skill content
"command": "python zodiac_api.py zone {{sign}}" ... "command": "python zodiac_api.py pairing {{sign1}} {{sign2}}"
Recommendation

Provide only supported formats such as 05-09, 5/9, or taurus2. The maintainer could add explicit argument schemas or validation.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

A user's month/day birthday, and possibly another person's month/day birthday for compatibility readings, may be sent to the declared third-party endpoint.

Why it was flagged

The skill discloses that birthday month/day inputs are sent to an external API for resolution and compatibility lookup.

Skill content
The Python client sends the month-day string only to the read-only zodiac API endpoint
Recommendation

Do not provide birth year, time, contact details, or other personal information; use a zodiac zone ID instead of a birthday if preferred.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

The skill may fail or behave differently in environments where Python is unavailable or mapped to an unexpected interpreter.

Why it was flagged

The registry requirement metadata does not declare Python as required, while the tool commands depend on a Python interpreter.

Skill content
Required binaries (all must exist): none ... command: python zodiac_api.py zone {{sign}}
Recommendation

Declare Python as a required runtime binary so users and agents understand the local execution requirement.