Lunar Calendar Vietnam

Security checks across malware telemetry and agentic risk

Overview

This appears to be a purpose-aligned Vietnamese lunar calendar skill that runs a local Node.js calculator and does not request credentials, persistence, or network access.

Before installing, confirm you are comfortable with a skill that runs a local Node.js calendar calculator and may require npm dependencies. There is no artifact evidence of credential use, exfiltration, persistence, or destructive actions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI05: Unexpected Code Execution
Low
What this means

For relevant calendar questions, the agent may run a local Node.js script instead of answering from memory.

Why it was flagged

The skill explicitly tells the agent to run a terminal command using the bundled Node.js calculator. This is central to the calendar-calculation purpose and is locally scoped, but users should notice that it involves command execution.

Skill content
Luôn luôn gọi terminal... node scripts/amlich_calculator.js --solar "2026-02-13"
Recommendation

Use the skill only if you are comfortable with local script execution, and keep invocations limited to the documented calculator command and date-style inputs.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

Using or reinstalling the skill may rely on Node.js/npm and the pinned minimist package.

Why it was flagged

The CLI uses a third-party npm dependency. The lockfile provides a pinned version and integrity hash, so this is a normal dependency-awareness note rather than a concern.

Skill content
"node_modules/minimist": { "version": "1.2.8", "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz", "integrity": "sha512-2yyAR8q..." }
Recommendation

Install dependencies from the lockfile when needed, and declare Node.js/npm requirements in metadata for clearer setup expectations.