Back to skill
Skillv1.0.0
ClawScan security
liuyao-divination · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 12:00 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements, instructions, and local reference files are internally consistent with a Chinese Six‑Yao divination (六爻) analysis tool and do not request unrelated credentials, network endpoints, or installation actions.
- Guidance
- This skill appears coherent for performing structured 六爻 divination: it only uses local reference files and requires no external credentials or installs. Before installing: (1) confirm you trust the skill author (source unknown) because the skill will run autonomously if the agent invokes it; (2) review the included references and output templates to ensure you are comfortable with the level of prescriptive forcing (it demands strict, stepwise outputs and may produce firm conclusions about health/legal matters); (3) if users may submit sensitive personal or medical data, consider adding safeguards or disclaimers—this is a fortune‑telling tool, not a substitute for professional medical, legal, or financial advice.
Review Dimensions
- Purpose & Capability
- okName/description (六爻解卦) match the contents: SKILL.md and many local reference files implement detailed divination rules. The skill does not request unrelated binaries, environment variables, or external services; all required materials are local references appropriate to the stated purpose.
- Instruction Scope
- noteThe SKILL.md tightly prescribes an eight‑step analysis workflow and mandates loading and using specific local reference chapters before each step. This is consistent with a formalized divination procedure, but it is highly prescriptive (requires explicit outputs and strict checks). No instructions ask the agent to access system files, environment variables, or external endpoints beyond the included reference files.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files to run; lowest installation risk. All references are packaged with the skill repository; there are no download URLs or external package installs.
- Credentials
- okThe skill declares no environment variables, no credentials, and no config paths. The SKILL.md only uses the structured input data the user supplies (date, duozhi, question, intent, and per‑yao fields). No sensitive platform credentials or unrelated tokens are requested.
- Persistence & Privilege
- okFlags are default (not always:true). The skill can be invoked autonomously (platform default) but does not request elevated privileges or modify other skills or system settings. It only reads its bundled reference files at runtime.