Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.js:38
Security audit
Bazi Pro
Security checks across malware telemetry and agentic risk
Overview
Bazi Pro appears to perform the advertised birth-chart analysis, but it reads broad local .env credential files and uses LLM API keys with configurable endpoints, so it should be reviewed before use.
Before installing, decide whether you are comfortable sending birth details to DeepSeek/OpenAI or a configured compatible endpoint. Prefer a dedicated skill-specific API key, avoid running it from directories with sensitive .env files, verify the package source, and use --no-interpret when you only want local chart calculation.
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.env_credential_access