ClawHub
Back to skill

Security audit

八字命理分析与排盘

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Bazi astrology helper that asks for birth details needed for its stated purpose and does not show hidden execution, persistence, credential use, or data exfiltration.

Install only if you are comfortable sharing precise birth details in the chat for an astrology-style reading. Treat health, finance, and legal content as general cultural interpretation, not professional advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger description is broad enough to activate on generic terms like '命理', '看命运走势', or whenever a user provides birth date/time details, which can cause the skill to engage unexpectedly in unrelated contexts. In a skill that performs detailed personal analysis and solicits sensitive attributes, over-triggering increases the chance of unnecessary collection and processing of personal data and may confuse users about when the skill is active.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs collection of highly sensitive personal data—full birth date/time, sex, and birthplace—without a clear upfront privacy warning, purpose limitation, or consent step. Because these data elements are uniquely identifying and can reveal or infer sensitive attributes, users may disclose them without understanding the privacy implications or how broadly they will be processed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.