ClawHub
Back to skill

Security audit

BaZi Fortune Hub

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent remote fortune-reading and forum integration, but users should understand that birth details and forum content are sent to an external service.

Install only if you are comfortable sending birth details, questions, and any requested forum posts/comments to fortunehub.lighttune.com.au with an API key. Do not post to the forum without reviewing the content first, and avoid sharing another person's birth information unless they consent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · examples/mcp-native.md (reported line 25)May include surrounding context.

md
| Agent | Transport | Suspected quirk |
|-------|-----------|-----------------|
| Codex CLI | stdio MCP | Config lives in `~/.codex/config.toml` `mcp_servers` block |
| Cursor | stdio MCP | Default tool timeout tight; same ≥120s guidance for t4 |
| OpenClaw | stdio MCP | Open-source framework; config file format varies per release |
| Hermes | HTTP MCP (SSE or streamable) | Python `mcp` client SDK; check stdio vs SSE support |

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The 'USE FOR' section mixes English with multiple Chinese trigger phrases and presents them as canonical invocation language, but nowhere in this file does the skill explicitly offer a user language choice or explain a locale restriction. Under the policy, forcing or privileging a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash
# MCP-style: list tools (meta + upstream + forum)
curl -X POST https://fortunehub.lighttune.com.au/api/mcp \
  -H "x-api-key: <your-key>" -H "content-type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The walkthrough instructs users to submit highly sensitive personal data, including full birth date/time, gender, and location, to a remote service, but this file does not prominently warn about privacy, retention, or third-party processing implications. In a fortune-reading context, this data is especially identifying and may be sensitive under privacy regimes, so omission of a clear warning increases the risk of uninformed disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/full-chain-walkthrough.md (reported line 31)May include surrounding context.

m1 — get_skill_info (free, always call first)

bash
curl -X POST https://fortunehub.lighttune.com.au/api/universal/meta/get_skill_info \
  -H "x-api-key: $KEY" -H "content-type: application/json" -d '{}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The sample final result shows the user-facing narrative in Chinese ("2026 是你的……") while the walkthrough is otherwise in English, and the file does not state that output language is fixed or region-specific. That creates a natural-language locale policy concern because it implies a specific language may be imposed without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/rest-only.md (reported line 68)May include surrounding context.

md
location: dict = Field(..., description='{"city_name": "Beijing"}')

def _call_fortune(name: str, payload: dict) -> dict:
    r = requests.post(
        f"{HUB_BASE}/api/universal/fortune/{name}",
        json=payload,
        headers={"x-api-key": API_KEY, "content-type": "application/json"},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The comment-creation tool performs a persistent write to a public forum, but unlike the post-creation tool it does not warn integrators to obtain explicit user confirmation before calling it. In an agent context, this increases the risk of unintended or prompt-induced external side effects, where the assistant could publish user content or agent-generated text without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest explicitly describes BaZi/fortune tools that require birth information and send requests to a remote MCP/REST endpoint, but it provides no privacy notice, data handling disclosure, or warning that sensitive personal data will leave the local agent context. Birth date/time and related profile details are personal data, and users may disclose more than expected when using a fortune-reading workflow, creating a real privacy and informed-consent risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes forum posting, commenting, and liking functions against an external community service, but the manifest does not warn that submitted content may be published externally and visible to others. This can lead to accidental disclosure of personal, sensitive, or agent-generated content because users may reasonably assume the interaction is private unless publication is clearly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The snippet includes example handling of detailed birth data and location, which are sensitive personal attributes, but provides no user-facing privacy warning, minimization guidance, or retention/consent considerations. In a fortune-reading skill, collecting this data is functionally relevant, but the lack of explicit privacy safeguards can lead agents to transmit sensitive data without informed user consent or clear necessity boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This markdown file includes an environment variable for FORTUNE_HUB_API_KEY, which involves sensitive credential handling. While the file explains how to configure the key, it does not warn users to protect the secret or avoid committing it to project config, and the skill description here does not include any disclosure about credential sensitivity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The example passes FORTUNE_HUB_API_KEY into a spawned subprocess environment, which is a sensitive operation involving credential handling. Although the snippet comments describe fallback mechanics, this markdown file does not warn users that the child process receives the credential or suggest handling precautions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes runnable example code that sends an API key in the x-api-key header and posts tool arguments to a remote hub, which can affect privacy and transmit user data. The file explains transport behavior and setup, but it does not explicitly warn readers here that REST fallback sends request data and credentials over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file specifies that inputs and outputs for fortune tools use Chinese stem/branch characters and labels such as 天干, 十神, and 问卦, and examples/return shapes are documented only with those locale-specific values. Because the documentation does not mention any language selection or opt-in, this may violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The example trigger phrase is written only in Chinese ("我是什么格局") and the document does not indicate that language selection is optional or limited to a region-specific use case. This can be a natural-language policy concern if the skill implicitly assumes a specific language without user opt-in.

Content

No source excerpt is available for this finding.