ClawHub
Back to skill

Security audit

horoscope

Security checks across malware telemetry and agentic risk

Overview

This horoscope skill is coherent and mostly transparent, but users should be aware that birth-chart requests may involve external taibu MCP tools.

Install only if you are comfortable using horoscope and astrology tools. Daily horoscope queries send the zodiac sign to ohmanda; bazi, ziwei, and similar requests may send birth details to whatever taibu MCP service is configured, so avoid sharing exact personal birth information unless you trust that service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill documentation describes code paths that read local files and access an external horoscope API, but it does not declare corresponding permissions. Undeclared capabilities reduce transparency and can bypass expected review or consent boundaries, especially for network access that sends user queries to third-party services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The documented behavior is inconsistent with the advertised purpose: it relies on an external ohmanda API not clearly disclosed in the top-level description and claims taibu MCP support that is not actually implemented in the described code artifacts. Description-behavior mismatches are dangerous because they mislead reviewers and users about data flows, trust boundaries, and what components are truly in use.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill invites users to submit sensitive birth date and time information to external taibu MCP tools without any privacy notice, consent prompt, or data-handling explanation. Birth data can be personally identifying and culturally sensitive, so silent transmission to third parties creates a meaningful privacy risk.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.