Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

易经占卜 I Ching Divination

v1.0.0

基于《周易》铜钱法和蓍草法起卦,生成本卦、互卦、变卦,提供诗性AI Oracle声音诠释用户提问。

0· 765·5 current·5 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (I Ching divination) matches the included script (scripts/divine.py) and the hexagram data assets. Requested capabilities and resources (no env vars, no external binaries) are proportionate. However, the docs disagree about how many hexagrams are included (SKILL.md claims only 10 examples, README/metadata claim 64, assets file appears to contain many entries) — this inconsistency is unexplained.
Instruction Scope
SKILL.md instructs the agent to run the local Python script, parse its JSON output, and read local hexagram data. Those actions are within the declared purpose. But there are doc/path mismatches: SKILL.md step 3 shows reading 'references/hexagrams.json' (this file is not present; the full data is in assets/hexagrams_full.json), and the README claims "no file I/O" which contradicts instructions that read/edit assets. These inconsistencies could cause runtime errors or confusion.
Install Mechanism
No install spec is provided (instruction-only with bundled script and assets). No external downloads, package managers, or extraction steps are declared — low install risk.
Credentials
The skill requests no environment variables or credentials. The code uses only the Python standard library and local files; nothing appears to access external secrets or unrelated system configuration.
Persistence & Privilege
Flags are default (always: false, user-invocable: true, model invocation allowed). The skill does not request permanent presence or attempt to modify other skills or system configuration.
What to consider before installing
This skill is largely coherent with its stated purpose (local I Ching divination) and contains only a small Python script plus data files, but there are multiple documentation mismatches you should resolve before installing or running it. What to check before installing/use: - Verify which hexagram data file is authoritative: SKILL.md references references/hexagrams.json (which is missing), README and references/hexagrams_metadata.json claim full 64, and SKILL.md claims only 10 examples. Open assets/hexagrams_full.json to confirm how many entries and whether the content is complete and accurate. - Confirm the script uses only local files and no network: review scripts/divine.py (it appears to use only the standard library and prints JSON). This script does not perform network requests or read external secrets. - Fix or be aware of doc/path typos: SKILL.md's file path should be updated to point to assets/hexagrams_full.json (or ensure references/hexagrams.json exists). Inaccurate docs (e.g., README saying "no file IO") reduce trustworthiness. - Run the script in a sandboxed environment first (non-production account) and inspect its output. If reproducibility matters, note that the script seeds randomness with hash(question) which may vary between Python runs due to Python's randomized hash seed — supply an explicit seed if you want deterministic results. If you need higher assurance, ask the maintainer (or request an updated package) to correct the documentation inconsistencies, include a clear mapping of where the 64 hexagrams are stored, and confirm there are no hidden network calls or extra install steps.

Like a lobster shell, security has layers — review code before you run it.

latestvk977vpvmdfa237bfepjb9na06x8156xe

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments