Back to skill
Skillv1.0.0
ClawScan security
fortune-telling(算命) · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 5:16 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- An instruction-only fortune-telling skill that asks for birthdate/time and returns deterministic horoscope-style readings; its requests and instructions are consistent with its stated purpose.
- Guidance
- This skill is internally coherent and appears to do only local, deterministic fortune calculations from the birthdate/time you provide. Before installing: (1) remember birthdate/time (and possibly gender/time of birth) is personal data—confirm you’re comfortable entering it; (2) the SKILL.md references gender for a calculation but doesn't explicitly request it—expect the skill to ask for gender or assume a default; (3) because it’s instruction-only, there’s no bundled code that reaches out to external servers, but the platform may log your queries—check the platform’s data/privacy policy if you’re concerned; (4) use outputs for entertainment only and don’t provide sensitive secrets. If you need stronger assurance, check the repository URL listed in package.json or request source code implementing the SKILL.md logic.
- Findings
[no_code_files_for_regex_scan] expected: The package contains only SKILL.md, README.md, and package.json; the regex-based scanner had no code files to analyze. This is expected for an instruction-only skill.
Review Dimensions
- Purpose & Capability
- okThe name/description (周易算命) match the instructions: parse birth date (including lunar), compute hexagrams and five-element analysis, and produce today/weekly/monthly reports. There is a minor documentation mismatch: the algorithm references gender for 本命卦 calculation, but the parameter list does not explicitly request gender—this is a small inconsistency in the SKILL.md, not an operational risk.
- Instruction Scope
- noteSKILL.md only describes local computations (date parsing, lunar conversion, deterministic random seed based on birthdate/current date) and output formatting. It requires personal data (birth date/time and optional question), which is expected for this purpose. The instructions do not direct the agent to read unrelated files, environment variables, or to send data to external endpoints.
- Install Mechanism
- okNo install spec and no code files (instruction-only). Nothing is downloaded or written to disk by the skill itself, so install risk is minimal.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. This is proportionate to an offline/logic-based fortune-telling skill.
- Persistence & Privilege
- okFlags show no always:true or other elevated persistence. The skill is user-invocable and may be invoked autonomously by the agent (platform default), which is normal and expected for skills.