Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AsianSeeker - Openclaw FortuneTeller
v1.0.2Mingli (命理) — Multi-system daily horoscope: Western astrology (natal chart + transits), Ba-Zi / Four Pillars (Bát Tự), numerology, I Ching (Kinh Dịch). Kerykeion + astronomyapi.com. Telegram delivery.
⭐ 0· 2.5k·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code and SKILL.md match the stated purpose: natal charts (kerykeion), Ba-Zi, numerology, I Ching, and planetary transits from astronomyapi.com with Telegram delivery. Declared dependency on kerykeion and use of astronomyapi are appropriate for astrology/astronomy data. However, the registry metadata claimed no required env vars or config paths while the scripts and references clearly expect ASTRONOMY_APP_ID and ASTRONOMY_APP_SECRET and write/read local memory files and cron state — an inconsistency.
Instruction Scope
Runtime instructions tell the agent to collect birth date/time/location and Telegram chat IDs, run local Python scripts, write persistent user data to ~/clawd/memory/horoscope-users.md and state/users.json, and create per-user cron jobs that post to Telegram. Those actions involve storing PII (birth data, lat/lon, chat IDs) and scheduling persistent tasks. The prompt template also references a different path (.claude/skills/daily-horoscope/...) than the skill slug (mingli), which is an incoherence that could break execution or cause the agent to search unexpected locations.
Install Mechanism
This is instruction-only (no install spec). The SKILL.md lists a pip dependency (kerykeion) which is a normal PyPI package for astrology; installing via pip is typical but not covered by an install script in the package. Because there's no controlled install spec, the agent may attempt to run pip at runtime — moderate risk if the package's provenance isn't verified.
Credentials
Registry metadata lists no required env vars, but scripts (fetch-planetary-positions.py) require ASTRONOMY_APP_ID and ASTRONOMY_APP_SECRET to call astronomyapi.com. The skill will also ask users for Telegram chat IDs (not env, but sensitive). The mismatch between declared and actual credential needs is an unambiguous incoherence. Requesting astronomy API credentials is proportionate to transit fetching, but the package should have declared those requirements.
Persistence & Privilege
The skill instructs creation of persistent cron jobs per user and writes user data to files under the user's home directory (~/clawd/...). That level of persistence and filesystem modification is expected for scheduled delivery but is a privileged capability and should be explicitly declared and consented to. Autonomous invocation is allowed (default) — combined with cron creation and persistent storage this increases blast radius if misused.
What to consider before installing
Key things to check before installing:
- Metadata mismatch: the registry claims no env vars/config paths but the scripts require ASTRONOMY_APP_ID and ASTRONOMY_APP_SECRET. If you plan to use transit data, you must provide these secrets. Verify where and how you will store them and whether the agent actually needs them.
- Persistent state & cron jobs: the skill writes user PII (birth date/time, lat/lon, LifePath number, Telegram chat IDs) to ~/clawd/memory/horoscope-users.md and state/users.json and creates cron jobs that send messages to Telegram. Make sure you are comfortable with those files being created in your home directory and with scheduled outgoing messages. Consider where those files will live, whether they are readable by others, and whether you want to allow the skill to create cron jobs.
- Telegram delivery: the skill expects to send messages to Telegram chat IDs. Confirm the integration uses trusted, platform-managed telegram_actions (do not paste your Telegram bot token into skill files) and verify what permissions the Telegram channel/ bot uses.
- Path/prompt incoherence: references/horoscope-prompt-template.md calls a script under .claude/skills/daily-horoscope/... while other examples use .claude/skills/mingli/.... That mismatch suggests the runtime prompt or examples may be broken or cause the agent to look in unexpected locations. Ask the author to fix the paths.
- Third-party packages: kerykeion (pip) is required for full natal-chart calculations. Verify the package's provenance (PyPI page, maintainers) before allowing pip install.
- Minimal test: run the included scripts locally with test data and without supplying ASTRONOMY credentials to confirm fallback behavior. Check what files are created and what exact network calls are made (fetch-planetary-positions.py uses astronomyapi.com only).
- If privacy is a concern, do not grant autonomous invocation or cron-creation rights until you review/modify the code to store data in an approved secure location, or to require explicit user approval per operation.
If you want, I can produce a short checklist / patch suggestions to (a) declare required env vars in the skill metadata, (b) fix the path typo in the prompt template, and (c) change where and how memory is stored (or make it configurable).Like a lobster shell, security has layers — review code before you run it.
latestvk970d7x4y5g3mm1y1vh4scryf980c9x5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.