Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its advertised Bazi report workflow, but it needs Review because it can read arbitrary local files and handles credentials and private data with weak boundaries.
Install only if you are comfortable sending phone/email login data and exact birth details to the external iaskmaster.cn service. Treat this as a Review item until the arbitrary file-read tool is constrained to generated reports, tokens are no longer printed or stored loosely, the API destination is allowlisted, and the installer asks before modifying OpenClaw configuration.
index.js:179Unrestricted Local File Read Through the PDF Reader Tool
index.js:55Authentication Token Embedded in Download URLs and Console Output
index.js:2Configurable API Origin Can Redirect Credentials and Sensitive Personal Data
index.js:2Bearer Token Stored in a Plaintext Relative File Without Explicit Access Controls
install.sh:122Installation Resolves and Installs an Unlocked Third-Party Dependency
The skill presents itself as a fortune-telling/report tool, yet installation and operational notes indicate dependency fetching, local workspace modification, configuration changes, and environment detection for local app variants. Hidden install-time or config-modifying behavior expands the attack surface and can alter the host environment in ways a user would not reasonably expect from the stated purpose.
The skill presents itself as a fortune-telling/report tool, yet installation and operational notes indicate dependency fetching, local workspace modification, configuration changes, and environment detection for local app variants. Hidden install-time or config-modifying behavior expands the attack surface and can alter the host environment in ways a user would not reasonably expect from the stated purpose.
Referenced artifact was not completely inspected
- 执行目录：在 skill 根目录（`SKILL.md` 所在目录）执行以下命令。 / Run commands in the skill root (where `SKILL.md` is located).
The skill collects and processes highly sensitive personal data, including name, gender, birth date/time, contact details for verification, and likely stores related reports and session state, yet the description provides no privacy warning or handling notice. This creates material risk of uninformed consent, overcollection, and unsafe retention of personal and account-linked data.
The skill collects highly sensitive personal data including name, birth date, birth time, gender, marital status, and location, then transmits it to a remote API for report generation. There is no meaningful privacy notice, consent gate, retention disclosure, or explanation of where this data is sent, which is especially risky given the intimate nature of the data.
The tool handler exposes iaskaster_read, which reads an arbitrary filename from user-controlled arguments and returns its contents as base64. This is a classic arbitrary local file read that exceeds the declared skill purpose and could disclose secrets such as tokens, SSH keys, config files, or other sensitive local data.
The skill not only downloads report files but also exposes a generic base64 file-content return path without natural-language safeguards or scope restrictions. In an agent setting, this materially increases the chance of silent data exfiltration because binary or document contents can be returned directly through tool output.
The README states that the skill sends data to an external iaskaster API and generates a PDF report, but it does not warn users that highly sensitive personal information may be transmitted off-platform. In this skill context, Bazi/fortune-telling workflows commonly involve birth date, birth time, gender, and other personal attributes, so the omission increases privacy and consent risk.
The skill exposes capabilities that imply environment access and network activity, but it declares no tool scope or permission boundaries. In practice this weakens reviewability and allows a seemingly simple fortune-telling skill to perform broader actions such as outbound requests, local state handling, and account/session operations without explicit user-visible constraints.
The trigger phrases are broad and generic, increasing the chance the skill is invoked when the user did not intend to start a workflow that may involve login, sensitive birth data collection, report downloads, or account actions. Because this skill handles personal data and account-linked operations, accidental activation is more dangerous than for a purely informational skill.
The skill includes browser-launching and headless screenshot automation for a recharge/payment page via child_process and puppeteer, which is unrelated to the stated Bazi PDF-report scope. Extra capabilities that can open browsers, probe local browser paths, and automate payment-page rendering increase attack surface and create opportunities for unintended UI automation or abuse in an agent context.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
#!/usr/bin/env node
import{readFileSync as k,writeFileSync as $,existsSync as _,mkdirSync as Be,rmSync as v}from"fs";import{resolve as D,dirname as Q}from"path";import{fileURLToPath as X}from"url";import{exec as C}from"child_process";import{createInterface as ee}from"readline";var ze=Q(X(import.meta.url)),te=process.env.IASKASTER_API_URL||"https://iaskmaster.cn",b=process.env.IASKASTER_TOKEN_FILE||".iaskaster-token",w=".iaskaster-uid";function S(){return _(b)?k(b,"utf-8").trim():null}function x(e){$(b,e,"utf-8")}function U(e){$(w,String(e),"utf-8")}function d(){return _(w)?k(w,"utf-8").trim():null}function ne(){_(w)&&v(w)}function B(){_(b)&&v(b)}async function g(e,t={}){let{skipAuth:n,...o}=t,r={"Content-Type":"application/json",...o.headers||{}};if(!n){let a=S();if(!a)throw new Error("\u672A\u767B\u5F55\uFF0C\u8BF7\u5148\u6267\u884C\u767B\u5F55\u6D41\u7A0B");r.Authorization=`Bearer ${a}`}let s=await fetch(`${te}${e}`,{...o,headers:r}),i=await s.json();if(s.status===401||i&&i.code===401)throw B(),new Error("\u274C \u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");if(!s.ok)throw new Error(`API\u8BF7\u6C42\u5931\u8D25: ${s.status}`);return i}function O(){return"\u8BF7\u63D0\u4F9B\u51FA\u751F\u4FE1\u606F\u8FDB\u884C\u516B\u5B57\u547D\u7406\u5206\u6790\uFF1A\u59D3\u540D______\uFF08\u5FC5\u586B\uFF09\uFF0C\u6027\u522B______\uFF08\u5FC5\u586B\uFF0C\u7537/\u5973\uFF09\uFF0C\u5A5A\u59FB\u72B6\u51B5______\uFF08\u5FC5\u586B\uFF0C\u5DF2\u5A5A/\u672A\u5A5A\uFF09\uFF0C\u51FA\u751F\u65E5\u671F______\u5E74______\u6708______\u65E5\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u65F6\u95F4______\u65F6______\u5206\uFF08\u5FC5\u586B\uFF0C24\u5C0F\u65F6\u5236\uFF09\uFF0C\u65E5\u5386\u7C7B\u578B______\uFF08\u5FC5\u586B\uFF0C\u516C\u5386/\u519C\u5386\uFF09\uFF0C\u51FA\u751F\u7701\u4EFD______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u57CE\u5E02______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u533A\u53BF______\uFF08\u9009\u586B\uFF09\uFF0C\u51FA\u751F\u62A5\u544A\u7C7B\u578B
...[truncated 26 chars]
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
#!/usr/bin/env node
import{readFileSync as k,writeFileSync as $,existsSync as _,mkdirSync as Be,rmSync as v}from"fs";import{resolve as D,dirname as Q}from"path";import{fileURLToPath as X}from"url";import{exec as C}from"child_process";import{createInterface as ee}from"readline";var ze=Q(X(import.meta.url)),te=process.env.IASKASTER_API_URL||"https://iaskmaster.cn",b=process.env.IASKASTER_TOKEN_FILE||".iaskaster-token",w=".iaskaster-uid";function S(){return _(b)?k(b,"utf-8").trim():null}function x(e){$(b,e,"utf-8")}function U(e){$(w,String(e),"utf-8")}function d(){return _(w)?k(w,"utf-8").trim():null}function ne(){_(w)&&v(w)}function B(){_(b)&&v(b)}async function g(e,t={}){let{skipAuth:n,...o}=t,r={"Content-Type":"application/json",...o.headers||{}};if(!n){let a=S();if(!a)throw new Error("\u672A\u767B\u5F55\uFF0C\u8BF7\u5148\u6267\u884C\u767B\u5F55\u6D41\u7A0B");r.Authorization=`Bearer ${a}`}let s=await fetch(`${te}${e}`,{...o,headers:r}),i=await s.json();if(s.status===401||i&&i.code===401)throw B(),new Error("\u274C \u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");if(!s.ok)throw new Error(`API\u8BF7\u6C42\u5931\u8D25: ${s.status}`);return i}function O(){return"\u8BF7\u63D0\u4F9B\u51FA\u751F\u4FE1\u606F\u8FDB\u884C\u516B\u5B57\u547D\u7406\u5206\u6790\uFF1A\u59D3\u540D______\uFF08\u5FC5\u586B\uFF09\uFF0C\u6027\u522B______\uFF08\u5FC5\u586B\uFF0C\u7537/\u5973\uFF09\uFF0C\u5A5A\u59FB\u72B6\u51B5______\uFF08\u5FC5\u586B\uFF0C\u5DF2\u5A5A/\u672A\u5A5A\uFF09\uFF0C\u51FA\u751F\u65E5\u671F______\u5E74______\u6708______\u65E5\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u65F6\u95F4______\u65F6______\u5206\uFF08\u5FC5\u586B\uFF0C24\u5C0F\u65F6\u5236\uFF09\uFF0C\u65E5\u5386\u7C7B\u578B______\uFF08\u5FC5\u586B\uFF0C\u516C\u5386/\u519C\u5386\uFF09\uFF0C\u51FA\u751F\u7701\u4EFD______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u57CE\u5E02______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u533A\u53BF______\uFF08\u9009\u586B\uFF09\uFF0C\u51FA\u751F\u62A5\u544A\u7C7B\u578B
...[truncated 26 chars]
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
#!/usr/bin/env node
import{readFileSync as k,writeFileSync as $,existsSync as _,mkdirSync as Be,rmSync as v}from"fs";import{resolve as D,dirname as Q}from"path";import{fileURLToPath as X}from"url";import{exec as C}from"child_process";import{createInterface as ee}from"readline";var ze=Q(X(import.meta.url)),te=process.env.IASKASTER_API_URL||"https://iaskmaster.cn",b=process.env.IASKASTER_TOKEN_FILE||".iaskaster-token",w=".iaskaster-uid";function S(){return _(b)?k(b,"utf-8").trim():null}function x(e){$(b,e,"utf-8")}function U(e){$(w,String(e),"utf-8")}function d(){return _(w)?k(w,"utf-8").trim():null}function ne(){_(w)&&v(w)}function B(){_(b)&&v(b)}async function g(e,t={}){let{skipAuth:n,...o}=t,r={"Content-Type":"application/json",...o.headers||{}};if(!n){let a=S();if(!a)throw new Error("\u672A\u767B\u5F55\uFF0C\u8BF7\u5148\u6267\u884C\u767B\u5F55\u6D41\u7A0B");r.Authorization=`Bearer ${a}`}let s=await fetch(`${te}${e}`,{...o,headers:r}),i=await s.json();if(s.status===401||i&&i.code===401)throw B(),new Error("\u274C \u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");if(!s.ok)throw new Error(`API\u8BF7\u6C42\u5931\u8D25: ${s.status}`);return i}function O(){return"\u8BF7\u63D0\u4F9B\u51FA\u751F\u4FE1\u606F\u8FDB\u884C\u516B\u5B57\u547D\u7406\u5206\u6790\uFF1A\u59D3\u540D______\uFF08\u5FC5\u586B\uFF09\uFF0C\u6027\u522B______\uFF08\u5FC5\u586B\uFF0C\u7537/\u5973\uFF09\uFF0C\u5A5A\u59FB\u72B6\u51B5______\uFF08\u5FC5\u586B\uFF0C\u5DF2\u5A5A/\u672A\u5A5A\uFF09\uFF0C\u51FA\u751F\u65E5\u671F______\u5E74______\u6708______\u65E5\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u65F6\u95F4______\u65F6______\u5206\uFF08\u5FC5\u586B\uFF0C24\u5C0F\u65F6\u5236\uFF09\uFF0C\u65E5\u5386\u7C7B\u578B______\uFF08\u5FC5\u586B\uFF0C\u516C\u5386/\u519C\u5386\uFF09\uFF0C\u51FA\u751F\u7701\u4EFD______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u57CE\u5E02______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u533A\u53BF______\uFF08\u9009\u586B\uFF09\uFF0C\u51FA\u751F\u62A5\u544A\u7C7B\u578B
...[truncated 26 chars]
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
#!/usr/bin/env node
import{readFileSync as k,writeFileSync as $,existsSync as _,mkdirSync as Be,rmSync as v}from"fs";import{resolve as D,dirname as Q}from"path";import{fileURLToPath as X}from"url";import{exec as C}from"child_process";import{createInterface as ee}from"readline";var ze=Q(X(import.meta.url)),te=process.env.IASKASTER_API_URL||"https://iaskmaster.cn",b=process.env.IASKASTER_TOKEN_FILE||".iaskaster-token",w=".iaskaster-uid";function S(){return _(b)?k(b,"utf-8").trim():null}function x(e){$(b,e,"utf-8")}function U(e){$(w,String(e),"utf-8")}function d(){return _(w)?k(w,"utf-8").trim():null}function ne(){_(w)&&v(w)}function B(){_(b)&&v(b)}async function g(e,t={}){let{skipAuth:n,...o}=t,r={"Content-Type":"application/json",...o.headers||{}};if(!n){let a=S();if(!a)throw new Error("\u672A\u767B\u5F55\uFF0C\u8BF7\u5148\u6267\u884C\u767B\u5F55\u6D41\u7A0B");r.Authorization=`Bearer ${a}`}let s=await fetch(`${te}${e}`,{...o,headers:r}),i=await s.json();if(s.status===401||i&&i.code===401)throw B(),new Error("\u274C \u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");if(!s.ok)throw new Error(`API\u8BF7\u6C42\u5931\u8D25: ${s.status}`);return i}function O(){return"\u8BF7\u63D0\u4F9B\u51FA\u751F\u4FE1\u606F\u8FDB\u884C\u516B\u5B57\u547D\u7406\u5206\u6790\uFF1A\u59D3\u540D______\uFF08\u5FC5\u586B\uFF09\uFF0C\u6027\u522B______\uFF08\u5FC5\u586B\uFF0C\u7537/\u5973\uFF09\uFF0C\u5A5A\u59FB\u72B6\u51B5______\uFF08\u5FC5\u586B\uFF0C\u5DF2\u5A5A/\u672A\u5A5A\uFF09\uFF0C\u51FA\u751F\u65E5\u671F______\u5E74______\u6708______\u65E5\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u65F6\u95F4______\u65F6______\u5206\uFF08\u5FC5\u586B\uFF0C24\u5C0F\u65F6\u5236\uFF09\uFF0C\u65E5\u5386\u7C7B\u578B______\uFF08\u5FC5\u586B\uFF0C\u516C\u5386/\u519C\u5386\uFF09\uFF0C\u51FA\u751F\u7701\u4EFD______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u57CE\u5E02______\uFF08\u5FC5\u586B\uFF09\uFF0C\u51FA\u751F\u533A\u53BF______\uFF08\u9009\u586B\uFF09\uFF0C\u51FA\u751F\u62A5\u544A\u7C7B\u578B
...[truncated 26 chars]
The request payload at L005 hard-codes lang:"zh_cn", and the surrounding prompts and outputs are all Chinese-language strings. This enforces a specific language/locale behavior without any visible opt-in, user choice, or documented justification for being China-specific.
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
PDF\u5DF2\u4FDD\u5B58: ${u}`),console.log(`
[PDF_READY]${u}[/PDF_READY]`),console.log("\u{1F4A1} \u62A5\u544A\u5DF2\u4E0B\u8F7D\uFF0C\u60A8\u53EF\u4EE5\u76F4\u63A5\u67E5\u770B\u6216\u53D1\u9001PDF\u6587\u4EF6"),u}async function q(){let e=await y();if(e.length===0){console.log("\u6682\u65E0\u547D\u7406\u5206\u6790\u8BB0\u5F55");return}console.log(`\u547D\u7406\u5206\u6790\u8BB0\u5F55\uFF1A
`),console.log("| ID | \u62A5\u544A\u540D\u79F0 | \u72B6\u6001 | \u751F\u6210\u65F6\u95F4 |"),console.log("|------|-------------------|--------|----------|");for(let t of e){let n=String(t.id).padStart(4," "),o=t.reportName.padEnd(15," "),r=t.status.padEnd(4," "),s=t.generatedAt.slice(0,10);console.log(`| ${n} | ${o} | ${r} | ${s} |`)}}var be={fortune:["\u8FD0\u6C14","\u8FD0\u52BF","\u6574\u4F53","\u7EFC\u5408","\u547D\u597D\u4E0D\u597D","\u547D\u8FD0"],wealth:["\u8D22\u8FD0","\u94B1","\u8D22\u5BCC","\u53D1\u8D22","\u6536\u5165","\u8D22\u8FD0\u5982\u4F55","\u8D22\u52A1"],career:["\u4E8B\u4E1A","\u5DE5\u4F5C","\u5347\u804C","\u521B\u4E1A","\u4E8B\u4E1A\u8FD0","\u804C\u4E1A","\u53D1\u5C55"],love:["\u611F\u60C5","\u6843\u82B1","\u5A5A\u59FB","\u604B\u7231","\u7231\u60C5","\u59FB\u7F18","\u4F34\u4FA3"],health:["\u5065\u5EB7","\u8EAB\u4F53","\u5E73\u5B89","\u75BE\u75C5"],yearly:["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0","\u4E00\u5E74\u8FD0\u6C14"],monthly:["\u672C\u6708","\u672C\u6708","\u6708\u8FD0","\u6708\u8FD0\u6C14"],help:["\u5E2E\u6211","\u5206\u6790","\u7B97\u547D","\u516B\u5B57","\u547D\u76D8","\u586B\u5199","\u8868\u683C"]};function M(e){let t=e.toLowerCase();for(let[n,o]of Object.entries(be))for(let r of o)if(t.includes(r)){let s;return["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0"].some(i=>t.includes(i))?s="this_year":["\u672C\u6708","\u6708\u8FD0"].some(i=>t.includes(i))&&(s="this_month"),{intent:n,period:s}}return{intent:"fortune"}}var we={fortune:{title:"\u6574\u4F53\u8FD0\u52BF",description:"\u7EFC\u5408\u5206\u6790\u547D\u4E3
...[truncated 27 chars]
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
PDF\u5DF2\u4FDD\u5B58: ${u}`),console.log(`
[PDF_READY]${u}[/PDF_READY]`),console.log("\u{1F4A1} \u62A5\u544A\u5DF2\u4E0B\u8F7D\uFF0C\u60A8\u53EF\u4EE5\u76F4\u63A5\u67E5\u770B\u6216\u53D1\u9001PDF\u6587\u4EF6"),u}async function q(){let e=await y();if(e.length===0){console.log("\u6682\u65E0\u547D\u7406\u5206\u6790\u8BB0\u5F55");return}console.log(`\u547D\u7406\u5206\u6790\u8BB0\u5F55\uFF1A
`),console.log("| ID | \u62A5\u544A\u540D\u79F0 | \u72B6\u6001 | \u751F\u6210\u65F6\u95F4 |"),console.log("|------|-------------------|--------|----------|");for(let t of e){let n=String(t.id).padStart(4," "),o=t.reportName.padEnd(15," "),r=t.status.padEnd(4," "),s=t.generatedAt.slice(0,10);console.log(`| ${n} | ${o} | ${r} | ${s} |`)}}var be={fortune:["\u8FD0\u6C14","\u8FD0\u52BF","\u6574\u4F53","\u7EFC\u5408","\u547D\u597D\u4E0D\u597D","\u547D\u8FD0"],wealth:["\u8D22\u8FD0","\u94B1","\u8D22\u5BCC","\u53D1\u8D22","\u6536\u5165","\u8D22\u8FD0\u5982\u4F55","\u8D22\u52A1"],career:["\u4E8B\u4E1A","\u5DE5\u4F5C","\u5347\u804C","\u521B\u4E1A","\u4E8B\u4E1A\u8FD0","\u804C\u4E1A","\u53D1\u5C55"],love:["\u611F\u60C5","\u6843\u82B1","\u5A5A\u59FB","\u604B\u7231","\u7231\u60C5","\u59FB\u7F18","\u4F34\u4FA3"],health:["\u5065\u5EB7","\u8EAB\u4F53","\u5E73\u5B89","\u75BE\u75C5"],yearly:["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0","\u4E00\u5E74\u8FD0\u6C14"],monthly:["\u672C\u6708","\u672C\u6708","\u6708\u8FD0","\u6708\u8FD0\u6C14"],help:["\u5E2E\u6211","\u5206\u6790","\u7B97\u547D","\u516B\u5B57","\u547D\u76D8","\u586B\u5199","\u8868\u683C"]};function M(e){let t=e.toLowerCase();for(let[n,o]of Object.entries(be))for(let r of o)if(t.includes(r)){let s;return["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0"].some(i=>t.includes(i))?s="this_year":["\u672C\u6708","\u6708\u8FD0"].some(i=>t.includes(i))&&(s="this_month"),{intent:n,period:s}}return{intent:"fortune"}}var we={fortune:{title:"\u6574\u4F53\u8FD0\u52BF",description:"\u7EFC\u5408\u5206\u6790\u547D\u4E3
...[truncated 27 chars]
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
PDF\u5DF2\u4FDD\u5B58: ${u}`),console.log(`
[PDF_READY]${u}[/PDF_READY]`),console.log("\u{1F4A1} \u62A5\u544A\u5DF2\u4E0B\u8F7D\uFF0C\u60A8\u53EF\u4EE5\u76F4\u63A5\u67E5\u770B\u6216\u53D1\u9001PDF\u6587\u4EF6"),u}async function q(){let e=await y();if(e.length===0){console.log("\u6682\u65E0\u547D\u7406\u5206\u6790\u8BB0\u5F55");return}console.log(`\u547D\u7406\u5206\u6790\u8BB0\u5F55\uFF1A
`),console.log("| ID | \u62A5\u544A\u540D\u79F0 | \u72B6\u6001 | \u751F\u6210\u65F6\u95F4 |"),console.log("|------|-------------------|--------|----------|");for(let t of e){let n=String(t.id).padStart(4," "),o=t.reportName.padEnd(15," "),r=t.status.padEnd(4," "),s=t.generatedAt.slice(0,10);console.log(`| ${n} | ${o} | ${r} | ${s} |`)}}var be={fortune:["\u8FD0\u6C14","\u8FD0\u52BF","\u6574\u4F53","\u7EFC\u5408","\u547D\u597D\u4E0D\u597D","\u547D\u8FD0"],wealth:["\u8D22\u8FD0","\u94B1","\u8D22\u5BCC","\u53D1\u8D22","\u6536\u5165","\u8D22\u8FD0\u5982\u4F55","\u8D22\u52A1"],career:["\u4E8B\u4E1A","\u5DE5\u4F5C","\u5347\u804C","\u521B\u4E1A","\u4E8B\u4E1A\u8FD0","\u804C\u4E1A","\u53D1\u5C55"],love:["\u611F\u60C5","\u6843\u82B1","\u5A5A\u59FB","\u604B\u7231","\u7231\u60C5","\u59FB\u7F18","\u4F34\u4FA3"],health:["\u5065\u5EB7","\u8EAB\u4F53","\u5E73\u5B89","\u75BE\u75C5"],yearly:["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0","\u4E00\u5E74\u8FD0\u6C14"],monthly:["\u672C\u6708","\u672C\u6708","\u6708\u8FD0","\u6708\u8FD0\u6C14"],help:["\u5E2E\u6211","\u5206\u6790","\u7B97\u547D","\u516B\u5B57","\u547D\u76D8","\u586B\u5199","\u8868\u683C"]};function M(e){let t=e.toLowerCase();for(let[n,o]of Object.entries(be))for(let r of o)if(t.includes(r)){let s;return["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0"].some(i=>t.includes(i))?s="this_year":["\u672C\u6708","\u6708\u8FD0"].some(i=>t.includes(i))&&(s="this_month"),{intent:n,period:s}}return{intent:"fortune"}}var we={fortune:{title:"\u6574\u4F53\u8FD0\u52BF",description:"\u7EFC\u5408\u5206\u6790\u547D\u4E3
...[truncated 27 chars]
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
PDF\u5DF2\u4FDD\u5B58: ${u}`),console.log(`
[PDF_READY]${u}[/PDF_READY]`),console.log("\u{1F4A1} \u62A5\u544A\u5DF2\u4E0B\u8F7D\uFF0C\u60A8\u53EF\u4EE5\u76F4\u63A5\u67E5\u770B\u6216\u53D1\u9001PDF\u6587\u4EF6"),u}async function q(){let e=await y();if(e.length===0){console.log("\u6682\u65E0\u547D\u7406\u5206\u6790\u8BB0\u5F55");return}console.log(`\u547D\u7406\u5206\u6790\u8BB0\u5F55\uFF1A
`),console.log("| ID | \u62A5\u544A\u540D\u79F0 | \u72B6\u6001 | \u751F\u6210\u65F6\u95F4 |"),console.log("|------|-------------------|--------|----------|");for(let t of e){let n=String(t.id).padStart(4," "),o=t.reportName.padEnd(15," "),r=t.status.padEnd(4," "),s=t.generatedAt.slice(0,10);console.log(`| ${n} | ${o} | ${r} | ${s} |`)}}var be={fortune:["\u8FD0\u6C14","\u8FD0\u52BF","\u6574\u4F53","\u7EFC\u5408","\u547D\u597D\u4E0D\u597D","\u547D\u8FD0"],wealth:["\u8D22\u8FD0","\u94B1","\u8D22\u5BCC","\u53D1\u8D22","\u6536\u5165","\u8D22\u8FD0\u5982\u4F55","\u8D22\u52A1"],career:["\u4E8B\u4E1A","\u5DE5\u4F5C","\u5347\u804C","\u521B\u4E1A","\u4E8B\u4E1A\u8FD0","\u804C\u4E1A","\u53D1\u5C55"],love:["\u611F\u60C5","\u6843\u82B1","\u5A5A\u59FB","\u604B\u7231","\u7231\u60C5","\u59FB\u7F18","\u4F34\u4FA3"],health:["\u5065\u5EB7","\u8EAB\u4F53","\u5E73\u5B89","\u75BE\u75C5"],yearly:["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0","\u4E00\u5E74\u8FD0\u6C14"],monthly:["\u672C\u6708","\u672C\u6708","\u6708\u8FD0","\u6708\u8FD0\u6C14"],help:["\u5E2E\u6211","\u5206\u6790","\u7B97\u547D","\u516B\u5B57","\u547D\u76D8","\u586B\u5199","\u8868\u683C"]};function M(e){let t=e.toLowerCase();for(let[n,o]of Object.entries(be))for(let r of o)if(t.includes(r)){let s;return["\u4ECA\u5E74","\u660E\u5E74","\u6D41\u5E74","\u5E74\u8FD0"].some(i=>t.includes(i))?s="this_year":["\u672C\u6708","\u6708\u8FD0"].some(i=>t.includes(i))&&(s="this_month"),{intent:n,period:s}}return{intent:"fortune"}}var we={fortune:{title:"\u6574\u4F53\u8FD0\u52BF",description:"\u7EFC\u5408\u5206\u6790\u547D\u4E3
...[truncated 27 chars]
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
\u274C \u63D0\u4EA4\u5931\u8D25: ${n.message}
`)}}async function Z(){if(c.uid)try{let e=await g(`/api/v1/fortune/reports?page=0&size=5&uid=${c.uid}`),t=[];if(Array.isArray(e))t=e;else if(e&&typeof e=="object"){let o=Object.keys(e);o.length>0&&Array.isArray(e[o[0]])&&(t=e[o[0]])}if(t.length===0){console.log(`\u{1F4CB} \u6682\u65E0\u62A5\u544A
`);return}let n=t[0];console.log(`\u{1F4CB} \u6700\u65B0\u62A5\u544A
`),console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501"),console.log(`\u{1F4C5} ${n.generatedAt?.slice(0,16).replace("T"," ")}`),n.storagePath&&console.log(`\u{1F517} ${n.storagePath}`),console.log(`\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
`),console.log(`\u{1F4A1} \u70B9\u51FB\u4E0A\u65B9\u94FE\u63A5\u4E0B\u8F7DPDF\u62A5\u544A
`)}catch(e){console.log(`
\u274C \u83B7\u53D6\u62A5\u544A\u5931\u8D25: ${e.message}
The installer unconditionally runs rm -rf "$SKILL_PATH" before recreating the skill directory, which deletes any preexisting installation without prompting or creating a backup. While the path is derived from expected config locations rather than direct user input, this can still cause unintended data loss if the user has modified the existing skill or stored files there.
The script edits the user's openclaw.json automatically to enable and load the skill, without an explicit warning or confirmation step. Silent configuration changes reduce user control and can unexpectedly alter application behavior, which is especially sensitive here because this is a third-party skill installer that also enables file watching and dependency installation behavior.
The activation phrases on these lines include broad fortune-telling terms like “算一卦”, “命盘”, “排盘”, and “运势”, which can appear in casual or metaphorical conversation without an actual request to invoke this specific plugin. Because the skill sends user data to an external API and supports authenticated workflows, ambiguous routing can expose private data or trigger external actions without sufficiently clear user intent.
The trigger sets include generic terms such as “登录”, “验证码”, “注册”, “充值”, “报告”, “结果”, “下载”, “查看”, and “解读”, which are common across many unrelated conversations. In a skill with network access, authentication flow, and file download capability, broad activation increases the chance of unintended invocation, causing unnecessary collection of sensitive birth/contact data or unexpected calls to the external service.
Detected: suspicious.env_credential_access