Bazi Calculator - Shunshi AI
v1.0.0Bazi chart calculation & reading (八字排盘与命理解读 / 四柱推命鑑定 / 사주팔자 감정). Triggers on: "算八字" "bazi reading" "四柱推命" "사주 봐주세요". Powered by shunshi-bazi-core with true s...
⭐ 0· 21·0 current·0 all-time
byShunshi AI@shunshi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual behavior: the skill runs a local Node.js calculator (scripts/calc.mjs) and depends on the shunshi-bazi-core package. No unrelated binaries, credentials, or config paths are requested.
Instruction Scope
SKILL.md confines runtime actions to collecting birth info from the user and running the provided calc.mjs script. It does not instruct the agent to read arbitrary files, access environment secrets, or transmit results to external endpoints. The only possible outward action is using 'world knowledge' to find lat/lon for city names — that is a behavioral guideline, not an instruction to call a specific external API.
Install Mechanism
There is no platform install spec in the registry, but SKILL.md instructs running 'npm install' which will fetch shunshi-bazi-core from the npm registry. This is expected for a Node-based skill, but installing third‑party npm packages can run lifecycle scripts (pre/postinstall) and execute code locally — review the dependency before install or run in an isolated environment.
Credentials
The skill requests no environment variables, credentials, or config paths. The provided calc.mjs only consumes CLI args and does not read environment secrets.
Persistence & Privilege
The skill is not always-enabled and does not request persistent/system privileges. It does not modify other skills or global agent settings; running npm will create node_modules in the skill directory (normal for Node projects).
Assessment
This skill appears to be what it claims: a local Node.js Bazi calculator that depends on the npm package shunshi-bazi-core. Before installing or running: (1) Inspect the shunshi-bazi-core package (npm page / repository) for its source, published version, and any install scripts (postinstall) — malicious packages can execute code during npm install. (2) Run npm install in an isolated environment (container or sandbox) if you cannot verify the dependency. (3) The calc.mjs script itself only prints JSON and does not exfiltrate data, but be cautious about how you resolve city coordinates: if you or the agent call external geocoding services to get lat/lon, you may send the user's birth/place data to third parties. Prefer user-supplied coordinates or a trusted/local lookup. (4) Consider pinning a specific dependency version instead of a caret range and auditing its code before long-term use. If you want, I can fetch and summarize the shunshi-bazi-core package (its npm metadata and repository) to help you evaluate it further.Like a lobster shell, security has layers — review code before you run it.
latestvk973bj79pksfmytdc5qg15za4184pgkw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.