ClawHub
Back to skill

Security audit

astron

Security checks for vulnerabilities and agentic risk

Overview

ClawScan gives this astrology skill a benign verdict because the reported capabilities are mostly purpose-aligned, though one scanner flagged a possible mismatch and the evidence is incomplete.

The verdict is benign, not a guarantee of safety. Consider whether the skill’s file and shell capabilities fit your needs and whether you are comfortable with its tool scope being undeclared. Confidence is medium: Skillspector reports partial analysis because a referenced local path could not be resolved, while the other scanner completed without findings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The supplied code implements a standalone general astrology calendar rather than personal natal-chart functionality. It accepts no birth profile, does not calculate or interpret a natal chart, and explicitly identifies its output as not being a personal transit calculation. This is a materially different capability from the declared chart-specific purpose. No unrelated resource access or suspicious side effects are evident in the supplied code.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
`natal` for JSON; optionally add `output` with a private `.json` path for natal, transits or progression (refuses overwrite); `svg` with an explicit private `output` ending in `.svg` for a natal chart; `transits` with timezone-aware `start_utc` and `end_utc` for a range of at most 370 days; or `progression` with `target_utc` for secondary progression JSON. Explain that saved SVG and JSON may contain sensitive birth details; do not share externally without permission. The SVG command refuses to overwrite existing files. For unknown birth time use `chart.py` and do not create a false house wheel, progression, or timed transit.

Transit calculations use 2-hour sampling and optional root refinement with the library's default aspects/orbs; sample resolution and range boundaries may miss or clip events. A `closest_sample_moment` with `exact_not_verified` is not an exact transit. Do not call an event exact solely because a library field is named exact; inspect `min_orb`, and describe samplin

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_features.py (reported line 6)May include surrounding context.

python
SCRIPT = Path(__file__).resolve().parents[1] / "scripts" / "astron.py"
BIRTH = {"date":"1990-07-15", "time":"10:30", "timezone":"Europe/Rome", "latitude":41.9028, "longitude":12.4964}
def run(operation, birth=BIRTH, **kwargs):
    return subprocess.run([sys.executable,str(SCRIPT)],input=json.dumps({"operation":operation,"birth":birth,**kwargs}),capture_output=True,text=True)
class AstronTest(unittest.TestCase):
    def test_natal_against_published_example(self):
        r=run("natal"); self.assertEqual(r.returncode,0,r.stderr)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_features.py (reported line 35)May include surrounding context.

python
def test_sky_lunations_against_usno(self):
        sky=SCRIPT.parent/"sky_events.py"
        payload={"start_utc":"2026-11-01","end_utc":"2026-11-30","timezone":"Asia/Jakarta","points":["Sun","Mercury"],"aspects":["conjunction"],"planets":["Mercury"]}
        r=subprocess.run([sys.executable,str(sky)],input=json.dumps(payload),text=True,capture_output=True)
        self.assertEqual(r.returncode,0,r.stderr)
        events=json.loads(r.stdout)["events"]
        self.assertTrue(any(e.get("phase")=="new" and e["iso_utc"].startswith("2026-11-09T07:02") for e in events))

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 592)May include surrounding context.

text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 604)May include surrounding context.

text
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/chart.py (reported line 27)May include surrounding context.

python
utc = valid[0]
    hour = utc.hour + utc.minute / 60 + (utc.second + utc.microsecond / 1e6) / 3600
    jd = swe.julday(utc.year, utc.month, utc.day, hour)
    ids = {n: getattr(swe, n.upper()) for n in ("sun", "moon", "mercury", "venus", "mars", "jupiter", "saturn", "uranus", "neptune", "pluto")}
    ids.update({"true_node": swe.TRUE_NODE, "mean_lilith": swe.MEAN_APOG, "chiron": swe.CHIRON})
    def point(x):
        x = x % 360