king-wen-hexagrams

v1.1.0

以文王六十四卦为根本,依用户所问定卦、排卦、解卦,并以庄重克制的口吻给出趋势判断、风险提醒与行止建议。适用于首次登记命主资料、问事起卦、已得卦象解读、卦义查询、每日运势与定时追问场景。

1· 102·0 current·0 all-time
bywjp@wjp-cn
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description (King Wen hexagrams, divination, daily fortunes) aligns with included assets and scripts: hexagram data, lookup, coin-to-hexagram parsing, divination composition, profile initialization, and templates. Required binaries (python) match the provided Python scripts. No unrelated binaries or credentials are requested.
Instruction Scope
SKILL.md narrowly defines when the skill should run and what it may ask for (question clarification, coin results, optional profile fields). The runtime docs explicitly advise not to reveal internal implementation to users. The skill does collect and persist minimal profile data (农历生日, 性别, optional 出生时辰) for personalization and daily-fortune flows — this is within the stated purpose but is sensitive personal data and is worth noting to users.
Install Mechanism
There is no external install spec in the skill registry (instruction-only), so the code files are not auto-downloaded from arbitrary URLs. However, package.json defines an npm postinstall hook (python scripts/postinstall_hint.py) that will run when the package is installed via npm and will print onboarding hints (including current saved state if present). The postinstall script only prints information and does not perform network calls or execute arbitrary remote code.
Credentials
The skill requests no environment variables or external credentials. The only runtime dependency is python to run included helper scripts. The only data collected are user-supplied profile fields (lunar birthday, gender, optional birth hour) — appropriate for a profile-aware divination skill but still personally identifiable information (PII) so users should be informed.
Persistence & Privilege
The skill persists user profile and daily-fortune scheduling data via local session_state scripts. always:false (no forced global enable). The cron command builder prints an OpenClaw CLI command (it does not execute it). There is no evidence the skill modifies other skills or system-wide settings beyond producing a command the user can run.
Assessment
This skill appears coherent and implements exactly what it claims: local hexagram data, coin/line parsing, templates, and optional local profile + daily-fortune scheduling helpers. Before installing or using it, consider the following: - Privacy: the skill encourages storing personal profile data (农历生日, 性别, optional 出生时辰) in local state. Review scripts/session_state.py to see where and how that data is stored (file path, plaintext vs. protected). If you are uncomfortable storing birth data, skip providing it — the skill allows skipping and can still run basic queries. - Cron/message leakage: the init_profile helper can produce an openclaw cron command that embeds the profile fields into the scheduled message. If you enable a cron job (or copy the printed command), the profile values will be present in the job metadata/message and may be visible to anyone who can list scheduled jobs or who receives the announced messages. Only enable scheduling if you accept that disclosure. - Postinstall behavior: installing via npm will run the postinstall script which prints onboarding text and, if a profile exists, shows saved state. That is informational only, but be aware it may output profile summary to stdout. - No network/exfiltration detected: the included Python scripts do not make network requests or require external credentials. The code prints or returns command strings rather than executing remote commands. Still, if you plan to run any of the scripts in an environment you care about, inspect scripts/init_profile.py, scripts/session_state.py and scripts/postinstall_hint.py to confirm storage locations and output behavior. - If you want extra caution: avoid entering highly sensitive data, do not run the generated cron command with --announce unless you intend the output to be publicly delivered, and consider running the skill in an isolated session if you will test scheduling. If you want, I can examine scripts/session_state.py for exact storage paths and format so you can decide whether to proceed.

Like a lobster shell, security has layers — review code before you run it.

latestvk970x4rwd0n2310v8mp6k4qkkx841182

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Binspython

Comments