Bazi

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only Bazi skill is coherent for its stated purpose, with the main watch-outs being personal birth information sent to a calendar API, optional API credentials, and unpinned GitHub install instructions.

Before installing, be aware that the skill asks for personal birth-related information and may send the birth date to apihz for calendar verification. If you provide an apihz ID/key, use a dedicated key. If installing manually from the README, pin or verify the GitHub source rather than blindly cloning the latest repository state.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Your birth date may be sent to the apihz calendar service when the skill verifies the chart.

Why it was flagged

The skill instructs the agent to send the user's birth date to an external calendar API for validation, which is disclosed and purpose-aligned but involves third-party handling of personal date information.

Skill content

阳历生日明确时，排盘必须优先调用 apihz 指定日期万年历 API 校验年柱、月柱、日柱

Recommendation

Use the API only if you are comfortable sharing the birth date with that service; ask the agent to skip API verification if you prefer not to send it externally.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you provide an apihz ID/key, the agent may use it to query the calendar API.

Why it was flagged

The skill allows optional use of a user's own apihz API credentials, even though registry metadata declares no primary credential; this appears purpose-aligned but is still credential handling.

Skill content

如果用户提供自己的 apihz ID/KEY，优先使用用户提供的值。

Recommendation

Provide only a dedicated, low-privilege API key for this service, and do not share unrelated account credentials.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Manual installation from the GitHub repository may install changed or unreviewed content.

Why it was flagged

The README suggests installing from an external GitHub repository without a pinned commit or tag, so users following the README could receive repository content that differs from the reviewed artifact.

Skill content

git clone https://github.com/jinchenma94/bazi-skill .claude/skills/bazi

Recommendation

Prefer the reviewed registry artifact or pin the GitHub install to a trusted commit or release.