Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Yinian Zwds

v2.1.0

一念紫微斗数 (Yinian Zi Wei Dou Shu) — 专业AI紫微斗数排盘解盘系统。三派合一:三合派/飞星派/占验派。触发词:紫微斗数、紫微、命盘、排盘、ZWDS、ziwei、Purple Star

0· 34·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vincent-vstudios/yinian-zwds.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Yinian Zwds" (vincent-vstudios/yinian-zwds) from ClawHub.
Skill page: https://clawhub.ai/vincent-vstudios/yinian-zwds
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install yinian-zwds

ClawHub CLI

Package manager switcher

npx clawhub@latest install yinian-zwds
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name/description (紫微斗数排盘解盘) matches the included code: calculation, prompt-building, and AI-driven report generation. However, ai_engine.py looks up API keys from environment variables and from ~/.openclaw/openclaw.json — neither the SKILL.md nor the registry metadata declare any required env vars or config paths. Reading the user's OpenClaw config is outside the declared scope and not obviously necessary to compute astrological charts; at minimum the skill should have declared these requirements.
!
Instruction Scope
SKILL.md explicitly instructs the agent to exec local Python scripts in ~/.openclaw/skills/yinian-zwds/scripts to generate charts. Those scripts in turn perform network calls (POSTs to external LLM endpoints) and read local config (~/.openclaw/openclaw.json) and environment variables. The SKILL.md does not disclose that network calls will be made to external AI services or that it will attempt to read application config. The explicit use of exec to run packaged code increases the runtime surface and the instructions give the agent direct permission to run these scripts.
Install Mechanism
There is no install spec (instruction-only in registry), but the bundle contains many code files (Python and web assets). Because the code is packaged with the skill, nothing needs to be downloaded during install; that lowers installation risk. However, the package contains an API server (api_app.py), bot/push scripts (daily_push.py, tg_bot_handler.py), and web assets — more functionality than the SKILL.md calls out, which increases the potential for unexpected use if the user runs those files.
!
Credentials
Registry metadata lists no required env vars/config paths, yet ai_engine.py and other modules access DEEPSEEK_API_KEY and OPENAI_API_KEY environment variables and attempt to read ~/.openclaw/openclaw.json to extract a DeepSeek key. Requesting access to the user's OpenClaw config (which may contain other credentials) is a high-sensitivity action that is not justified or declared in SKILL.md. The code will send prompts and user birth data to external AI endpoints (DeepSeek/OpenAI) using these keys.
Persistence & Privilege
The skill does not set always: true and does not request special platform privileges. That said, the package includes an HTTP API (FastAPI app), Telegram handler, and scheduled push script — any of which could be launched by a user or agent run and would create persistent network-facing behavior. The SKILL.md does not instruct running the server, but presence of these components increases potential persistence if executed.
What to consider before installing
This skill appears to implement a real Zi Wei Dou Shu (astrology) system and includes code to build prompts and call external LLM APIs, which is consistent with the description — but there are important mismatches you should consider before installing or running it: - Undeclared secret access: The code will look for DEEPSEEK_API_KEY and OPENAI_API_KEY and will attempt to read your OpenClaw config at ~/.openclaw/openclaw.json to extract keys. The registry metadata did not declare these env vars or config paths. If you have sensitive keys in those locations, the skill will use them to call external services. - Network behavior: Running the provided scripts will send chart data and AI prompts (including users' birth info) to external AI endpoints (DeepSeek/OpenAI). This is expected for LLM-powered output, but you should be aware data will leave your machine when these scripts are executed. - Extra components not documented in SKILL.md: The package includes an API server (FastAPI), a Telegram handler, and scheduled push logic. These components could expose data or start outgoing connections if run; SKILL.md primarily documents interactive use but does not warn about these modules. Recommendations: 1. Inspect the code yourself or have someone you trust review ai_engine.py and any network call before running. Verify exactly what data is sent in requests. 2. If you want to try it, run it in an isolated environment (VM or container) without sensitive keys present. Provide only ephemeral/test API keys if needed. 3. Prefer to run the calculation-only parts (zwds_calc.generate_astrolabe) locally first to validate outputs; avoid running scripts that call call_llm or start api_app unless you intend those behaviors. 4. Ask the publisher to update SKILL.md and registry metadata to declare required env vars/config paths and to explicitly document the network calls and optional server components. If you want, I can list the exact lines/files that read environment variables or the OpenClaw config and the functions that perform network requests so you can inspect them more quickly.

Like a lobster shell, security has layers — review code before you run it.

latestvk97318khfmqgkr1k0p2w5bcn5h85jnnj
34downloads
0stars
1versions
Updated 1d ago
v2.1.0
MIT-0

一念紫微斗数 (Yinian ZWDS)

三派合一的专业AI紫微斗数排盘解盘系统。师承中州派、钦天门、紫云体系。

使用时机

当用户请求以下时启用此技能:

  1. 排盘:用户提供出生年月日时,请求紫微斗数命盘
  2. 解盘:请求命盘解读、宫位分析、星曜分析、四化解读
  3. 流派分析:指定使用三合/飞星/占验/综合哪一派解读
  4. 流年运势:大限/流年/流月运势
  5. 星曜查询:询问具体星曜含义、宫位含义

触发关键词

紫微斗数、紫微、命盘、排盘、zwds、ziwei、purple star、紫微排盘、紫微命盘、四大神数之首

技能结构

yinian-zwds/
├── SKILL.md                ← 本文件(核心指南)
├── ETHICS.md               ← 伦理准则
├── references/
│   ├── stars.md            ← 星曜详解(14主星+辅星)
│   ├── palaces.md          ← 12宫详解
│   ├── mutagen.md          ← 四化体系详解(含生年四化表)
│   ├── sanhe.md            ← 三合派/飞星派/占验派理论
│   └── patterns.md         ← 特殊格局(预留)
└── scripts/
    └── zwds_calc.py        ← 紫微斗数排盘Python脚本(精确排盘用)

用户引导

排盘请求

当用户请求排盘时,收集出生信息:

🔮 一念紫微斗数排盘系统

请提供您的出生信息:
1. 出生日期:公历年/月/日(如 2000-8-16)
2. 出生时辰:几点(0-23点,越精确越好)
3. 性别:男/女
4. 流派偏好(可选):三合/飞星/占验/综合(默认综合)

📌 如知道农历生日,请注明

排盘方法

方法一(推荐):调用排盘脚本 → 使用exec工具运行:

cd ~/.openclaw/skills/yinian-zwds/scripts && python3 -c "
from zwds_calc import generate_astrolabe, format_astrolabe
r = generate_astrolabe('2000-8-16', 6, '男')
print(format_astrolabe(r) if r else '排盘失败')
"

如果接收的输入是农历:

cd ~/.openclaw/skills/yinian-zwds/scripts && python3 -c "
from zwds_calc import generate_astrolabe, format_astrolabe
r = generate_astrolabe('2000-7-17', 6, '男', is_lunar=True)
print(format_astrolabe(r) if r else '排盘失败')
"

方法二(无脚本时):使用下方【排盘基础】知识手动推算。

解盘流程

用户请求 → 收集出生信息 → 排盘(脚本或手动)
    ↓
按流派解盘:
    ├─ 三合派 → 星曜性质 + 三方四正 + 亮度
    ├─ 飞星派 → 宫干四化脉络 + 自化 + 追禄追忌
    ├─ 占验派 → 太岁入卦 + 特殊格局
    └─ 综合 → 三派融合分析
    ↓
输出结论建议(🛑 均标注:文化参考,理性看待)

深度解盘引导

排盘完成后可问:

命盘已排出,您可以了解:
🏠 命宫解读 → 性格格局
💰 财帛宫 → 求财方式
💼 官禄宫 → 事业方向
💕 夫妻宫 → 感情姻缘
🔄 迁移宫 → 外出发展
🧘 福德宫 → 精神世界
📅 生年四化 → 命运脉络
⚡ 三方四正 → 宫位联动

排盘基础

12 宫名称与顺序

索引宫名英文三方四正
0命宫Life财帛宫(4) 官禄宫(8) 迁移宫(6)
1兄弟宫Siblings疾厄宫(5) 田宅宫(9) 交友宫(7)
2夫妻宫Marriage迁移宫(6) 福德宫(10) 官禄宫(4)
3子女宫Children交友宫(7) 父母宫(11) 田宅宫(5)
4财帛宫Wealth官禄宫(8) 命宫(0) 福德宫(2)
5疾厄宫Health田宅宫(9) 兄弟宫(1) 父母宫(3)
6迁移宫Travel命宫(0) 夫妻宫(2) 福德宫(10)
7交友宫Friends子女宫(3) 兄弟宫(1) 父母宫(11)
8官禄宫Career财帛宫(4) 命宫(0) 夫妻宫(2)
9田宅宫Property疾厄宫(5) 兄弟宫(1) 子女宫(3)
10福德宫Spirit迁移宫(6) 财帛宫(4) 夫妻宫(2)
11父母宫Parents交友宫(7) 子女宫(3) 疾厄宫(5)

14 主星

紫微(己土·帝星):领导力、贵气。喜左辅右弼。陷则刚愎。 天机(乙木·智星):聪明、策划、变动。喜天梁太阴。 太阳(丙火·阳):光明、公益、发散。庙旺宽厚,陷则劳碌。 武曲(辛金·财帛主):财富、刚毅、决断。喜天府天相。 天同(壬水·福星):福气、协调。庙旺安逸,陷则懒散。 廉贞(丁火·次桃花):是非、权术、文艺。庙旺清正。 天府(戊土·库星):稳定、包容、守成。喜紫微武曲。 太阴(癸水·阴):温柔、美感、财富。庙旺有情调。 贪狼(甲木·桃花主):交际、才艺、欲望。庙旺才艺。 巨门(癸水·暗星):口才、是非、思辨。喜日月。 天相(壬水·印星):诚信、公正、辅佐。喜紫微天府。 天梁(戊土·荫星):贵气、长寿、清高。喜天机太阳。 七杀(庚金·将星):权威、变动。庙旺威震八方。 破军(癸水·耗星):变革、突破。喜贪狼七杀。

亮度体系

> > > > >

  • 庙/旺:星曜力量最强,大吉
  • 得:中等正面
  • 利:偏正面
  • 平:中性
  • 陷:力量弱,偏凶

生年四化表

甲:廉贞禄  破军权  武曲科  太阳忌
乙:天机禄  天梁权  紫微科  太阴忌
丙:天同禄  天机权  文昌科  廉贞忌
丁:太阴禄  天同权  天机科  巨门忌
戊:贪狼禄  太阴权  右弼科  天机忌
己:武曲禄  贪狼权  天梁科  文曲忌
庚:太阳禄  武曲权  太阴科  天同忌
辛:巨门禄  太阳权  文曲科  文昌忌
壬:天梁禄  紫微权  左辅科  武曲忌
癸:破军禄  巨门权  太阴科  贪狼忌

四化含义

  • 化禄:增加、融合、顺利(大吉)
  • 化权:主导、掌控、权威(吉带刚)
  • 化科:文雅、名声、调和(吉善)
  • 化忌:缺失、纠葛、收缩(凶,需注意)

三方四正

本宫 + 对宫(±6) + 三合左(±4) + 三合右(±8)

例:命宫(寅=2) → 迁移宫(申=8)对宫 + 财帛宫(午=6) + 官禄宫(戌=10)

空宫处理

空宫(无主星)→ 借对宫星曜论断,需标明"借"


三派解读要点

三合派(中州派体系)

  • 核心:星曜性质 × 亮度 × 三方四正
  • 主星组合定格局(如紫府相格、杀破狼格)
  • 生年四化为命运主线
  • 常用星组:紫府相、杀破狼、机月同梁、日月同宫

飞星派(钦天门体系)

  • 核心:宫干四化轨迹串联
  • 重点看:飞宫四化、自化、追禄追忌
  • 来因宫定人生起点方向
  • 体用宫分体(本质)和用(表现)

占验派(紫云体系)

  • 核心:太岁入卦 + 星曜互涉
  • 重点:特殊格局识别
  • 六亲宫活用与转换

解盘输出规范

📜 文化参考,理性看待

【命主基本信息】
四柱:XXX

【XX宫解读】
三合派视角:星曜组合 + 亮度 + 三方四正联动的解读...
飞星派视角:四化脉络轨迹...

【结论建议】
...
📜 以上内容由AI生成,仅供文化参考

语言风格: 专业但不晦涩,用比喻帮助理解。语气用"可能性",不用"一定""注定"等绝对化断言。


伦理提醒

  • 所有解读开头/结尾标注「📜 文化参考,理性看待」
  • 不提供医疗、财务、法律建议
  • 不允许用户基于命盘做重大人生决策
  • 保护用户隐私,不持久存储生辰信息
  • 明确标注为AI生成,非真人命理师

详见 ETHICS.md

Comments

Loading comments...