MysticX Tarot Drawer
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
NoteHigh Confidence
ASI07: Insecure Inter-Agent CommunicationWhat this means
Personal details included in a tarot question may be transmitted to MysticX.ai and returned in the API response.
Why it was flagged
The skill instructs the agent to send user-provided tarot questions to MysticX.ai. This external data flow is disclosed and aligned with the reading feature, but users should understand that question text leaves the chat.
Skill content
When the user asks a question along with their draw request ... always pass it as the `question` parameter. The API echoes it back...
Recommendation
Use the skill only if comfortable sharing the wording of tarot questions with MysticX.ai; avoid including highly sensitive personal information.