易经占卜 I Ching Divination

• Analyzed: May 12, 2026, 4:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: bfca9fe7e3e487a9f0f34db21a9420c5122be322d0c4d31ef86cb0f82a76bb44
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a critical shell injection vulnerability in `SKILL.md`. The instructions for the AI agent, `result=$(python3 scripts/divine.py --method coin --question "{用户问题}")`, directly interpolate user input (`{用户问题}`) into a bash command. If the OpenClaw agent does not properly sanitize or quote this input, a malicious user could inject arbitrary shell commands, leading to Remote Code Execution (RCE). While the Python script (`scripts/divine.py`) itself is benign and performs no external I/O or network calls, the method of execution described in `SKILL.md` presents a significant security risk. The `README.md`'s claim of 'No code execution risk' is therefore inaccurate in the context of the agent's execution model.