MysticX Tarot Drawer

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 1.1.1
• Hash: 724b744f3e26722f5bf3337b12011a55ae413feca924978436823d6ff8f4c08b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's instructions are primarily benign, directing the OpenClaw agent to interact with the mysticx.ai API for tarot card services. However, it instructs the agent to pass user-provided input directly into URL query parameters (e.g., `question`) and to render API-provided strings (e.g., `Card Name`, `imageUrl`) as markdown. These patterns, found in SKILL.md, introduce potential vulnerabilities such as URL injection or markdown injection if the OpenClaw agent does not adequately sanitize or encode user input and API responses before making requests or rendering output. While there is no evidence of intentional malicious behavior, these risky capabilities warrant a 'suspicious' classification due to the potential for exploitation.