Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

AI Fortune Teller

v1.0.0

AI玄学大师 - 八字命理、塔罗占卜、运势分析。基于传统命理典籍与现代AI技术融合的智能占卜工具。

0· 76·0 current·0 all-time
by姜AGI@jackjls

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jackjls/ai-fortune-teller.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "AI Fortune Teller" (jackjls/ai-fortune-teller) from ClawHub.
Skill page: https://clawhub.ai/jackjls/ai-fortune-teller
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ai-fortune-teller

ClawHub CLI

Package manager switcher

npx clawhub@latest install ai-fortune-teller
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to run as an instruction-only fortune-teller and the features (八字、塔罗、K线图、画像) align with the included scripts. However, the registry metadata and SKILL.md declare no required environment variables or binaries, while the bundled scripts clearly require a MiniMax API key (MINIMAX_API_KEY / MINIMAX_API_HOST) and expect utilities like curl, jq, and Python. That mismatch suggests the metadata is incomplete and/or misleading.
!
Instruction Scope
SKILL.md tells the user to call the agent via chat or configure an API key for standalone use, but the actual scripts (scripts/fortune.sh, kline_generator.py, portrait_generator.py) do more: they read a local ~/.clawd/.env file and export its contents, call remote MiniMax endpoints with user-provided personal data (names, birth dates), and write output to /tmp. Reading and exporting a whole .clawd/.env is scope creep (may load unrelated secrets). The scripts also assume local CLI tools (curl, jq) and Python runtime availability that the skill metadata does not declare.
Install Mechanism
There is no remote install step or download from external URLs; the skill is instruction-only with bundled scripts, so there is no high-risk install mechanism. Files included are local scripts and markdown; nothing is fetched from arbitrary third-party URLs during install.
!
Credentials
The skill metadata lists no required env vars, but the code requires MINIMAX_API_KEY (and optional MINIMAX_API_HOST). The fortune.sh script loads and exports all variable lines from $HOME/.clawd/.env, which can inadvertently expose unrelated secrets stored there. Requiring an API key for the external MiniMax service is reasonable for functionality, but failing to declare that requirement and reading a shared .env file are disproportionate and risky.
Persistence & Privilege
The skill does not request always:true and can be invoked by the user only. It writes output files (e.g., /tmp/kline_<name>_YYYYMMDD.json) and calls external APIs, but it does not modify other skills or system-wide configuration. File writes to /tmp and local JSON storage are normal for this type of tool.
What to consider before installing
Before installing or running this skill: 1) Know that the bundled scripts call an external MiniMax API and expect MINIMAX_API_KEY (and optionally MINIMAX_API_HOST) even though the skill metadata does not declare it—if you don't set the key the scripts will fail. 2) The shell script sources and exports everything in $HOME/.clawd/.env; review that file first (it could contain other credentials) or run the skill in an isolated account/container to avoid exposing unrelated secrets. 3) Ensure your environment has curl, jq, and Python3 available as the scripts call them but the skill doesn't declare those binaries. 4) Understand that personal data (names, birth dates, birthplace) are sent to the external API endpoints—if that is sensitive, consider not using or use throwaway data. 5) If you proceed, supply only a dedicated MiniMax API key you can revoke and run the scripts in a sandboxed environment; request the author to update the skill metadata to declare required env vars and runtime binaries (MINIMAX_API_KEY, MINIMAX_API_HOST, curl, jq, python3) and to stop exporting arbitrary .clawd/.env content.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🔮 Clawdis
latestvk97e4zx2z8xvhgxs5ykpprrcmx848fvf
76downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

AI玄学大师 🔮

智能命理占卜工具,融合传统命理典籍与现代AI技术。

功能模块

1. 八字命理分析

输入:出生年月日时(农历/公历) 输出:四柱八字、十神格局、大运流年、事业/财运/婚姻/健康分析

2. 塔罗占卜

输入:占卜问题 输出:牌阵解读、正逆位含义、指引建议

3. 每日运势推送

输入:出生信息(可选) 输出:综合运势、事业/爱情/健康/财运评级 + 建议

4. 人生K线图 ✅

输入:八字命盘 输出:可视化运势曲线图(股票K线风格) 实现:MiniMax image-01 模型生成

5. 前世画像 ✅

输入:出生年月 输出:AI生成前世画像 + 灵魂特质解读 实现:MiniMax image-01 + 八字五行推演

6. 未来伴侣画像 ✅

输入:出生年月 + 性别 输出:AI生成理想伴侣画像 + 命盘特征解读 实现:MiniMax image-01 + 配偶星推演

使用方式

八字分析

【八字命理分析】
姓名:XXX
性别:X
出生地:XXX省XXX市
公历出生日期:XXXX年X月X日
出生时间:X时
(可选)农历出生日期:XXXX年X月X日

塔罗占卜

【塔罗占卜】
问题:XXX
牌阵:单张/三张/凯尔特十字/其他
(可选)抽到的牌:XXX

运势查询

【今日/本周/本月运势】
姓名:XXX(可选)
出生年月日:XXXX年X月X日(可选)
需要分析的方向:事业/爱情/财运/健康/综合

技术实现

  • 命理提示词:参考《穷通宝鉴》《滴天髓》《渊海子平》《三命通会》等典籍
  • AI模型:MiniMax API(支持function call + 对话记忆)
  • 可视化:MiniMax 图片生成 API
  • 数据存储:本地JSON(用户命盘数据)

定价(未来)

版本功能价格
免费版单次八字基础分析¥0
基础版八字+塔罗+运势¥99/年
进阶版全功能 + 人生K线图¥199/年
定制版私人命理师 + 无限咨询¥999/年

合规声明

本工具仅提供娱乐性质命理分析,不构成专业命理建议。运势结果仅供参考,人生决策请理性判断。

Comments

Loading comments...