Daily Horoscope Creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:36 AM UTC
• Version: 1.2.1

Overview

The skill mostly matches a horoscope image generator, but it needs review because install/configuration guidance and API-key handling are under-scoped, and it changes API scores while presenting them as real data.

Review before installing. Use a pinned, trusted ClawHub CLI version, create and protect config.json carefully, verify the TianAPI endpoint URLs yourself, and treat the generated scores as post-processed entertainment content rather than a direct rendering of API data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:26

Finding

Mutable Installation Dependency Executes Unpinned Remote Code

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 26-29
Vulnerability Type: Unpinned package execution during installation
Risk Level: Medium

bash

npx clawhub@latest install daily-horoscope

Technical Analysis

The documented installation procedure instructs users to execute the mutable latest release of the clawhub package through npx. Unlike a version-pinned and integrity-verified dependency, the code represented by latest can change after this skill has been reviewed.

npx may download the selected package and execute its command-line entry point under the privileges of the invoking user. Consequently, compromise of the package, its publishing account, its dependency chain, or the package registry could cause the installation command to execute code that was not included in this audit.

The same unsafe command also appears in SKILL.md at lines 25-27. No package version, checksum, lockfile, signature, or other integrity control is supplied.

Attack Path

1. An attacker compromises the clawhub package, a transitive dependency, the associated publisher account, or the package distribution channel.
2. The attacker publishes a malicious release and causes it to be selected by the latest tag.
3. A user follows the project documentation and runs npx clawhub@latest install daily-horoscope.
4. npx retrieves and executes the mutable package.
5. The malicious package executes with the permissions of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution as the user performing installation. Depending on that user's privileges, an attacker could read or modify accessible files, steal environment credentials and API keys, alter installed skills, execute network requests, or establish persistence.

The audited project does not itself contain evidence that the current clawhub package is malicious. The risk arises from executing a ...[truncated 53 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, exact package version, for example npx clawhub@X.Y.Z.
• Where supported, verify package signatures, provenance attestations, or published checksums before execution.
• Use a lockfile or an equivalent reproducible installation mechanism.
• Document the expected package publisher and registry to reduce registry-substitution risk.
• Run the installer under a dedicated, least-privileged account or isolated environment.
• Update every occurrence of the command, including SKILL.md, so users are not directed to the unsafe alternative.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_horoscope_tianapi.py:173

Finding

API Key Is Transmitted in GET Query Parameters to Configurable Endpoints

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_horoscope_tianapi.py, lines 173-184
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: Medium

python

params = {
    "key": TIANAPI_KEY,
    "astro": constellation,
}

if date_str:
    params["date"] = date_str

try:
    response = requests.get(TIANAPI_URL, params=params, timeout=10)
    data = response.json()

The same pattern is used for the pairing endpoint at lines 300-307:

python

params = {
    "key": TIANAPI_KEY,
    "me": sign1_short,
    "he": sign2_short,
}

try:
    response = requests.get(TIANAPI_PAIR_URL, params=params, timeout=10)

The destination URLs are loaded from local configuration at lines 57-59:

python

TIANAPI_KEY = config['tianapi']['key']
TIANAPI_URL = config['tianapi']['urls']['fortune']
TIANAPI_PAIR_URL = config['tianapi']['urls']['pair']

Technical Analysis

Passing params to requests.get serializes the API key into the request URL. The resulting URL has a form such as:

text

https://configured-endpoint.example/path?key=API_KEY&astro=...

Query strings are commonly retained by destination servers, reverse proxies, observability systems, debugging tools, and HTTP access logs. HTTPS protects the request from ordinary network interception but does not prevent the destination or intermediary infrastructure terminating TLS from recording the complete URL.

The destination URLs are also accepted directly from config.json without validation of scheme or hostname. If configuration is supplied from an untrusted package, shared archive, automation system, or modified workspace, the key can be sent directly to an attacker-controlled endpoint. The repository does not include the documented config.json.example or .gitignore, making it harder for users to verify the intended endpoint schema and increasing the likelihood o ...[truncated 1440 chars]

Remediation

View remediation

Remediation Suggestions

• If TianAPI supports it, transmit the key in an authorization header or request body rather than in the URL query string.
• Restrict endpoint configuration to an explicit HTTPS hostname allowlist. Reject HTTP URLs, embedded credentials, unexpected ports, redirects to unapproved hosts, and malformed URLs.
• Disable automatic redirects or validate every redirect destination before forwarding credentials.
• Keep separate constants for approved TianAPI endpoints rather than accepting arbitrary credential destinations from user-controlled configuration.
• Ensure logging and exception handling never emit request URLs containing credentials.
• Add the documented config.json.example with safe, fixed HTTPS endpoint values and a placeholder key.
• Add an actual .gitignore entry for scripts/config.json and other secret-bearing files.
• Prefer environment variables or an operating-system secret store for the API key, and document restrictive filesystem permissions if a configuration file remains necessary.
• Rotate the key immediately if it may already have appeared in HTTP access logs or shared configuration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill creates 12 constellation fortune images via TianAPI for multi-page social media publishing. This code chunk does not implement any of that functionality. It is only a reference/constants module for zodiac symbols and related metadata, with basic lookup helpers. While such a module could support a larger constellation-image workflow, this chunk’s actual behavior is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description says this skill creates 12 constellation fortune images via TianAPI for social-media publishing. The provided code chunk is only a data/logic module containing static constellation information and utility functions for compatibility, health advice, lucky direction/time, and fortune level. There is no code for image creation, pagination, font/layout handling, social-media formatting, or publishing. There is also no actual TianAPI request logic in this chunk; instead it includes a pinyin map and comments referring to 万维易源/Wanwei Yiyuan. Because the implemented primary purpose is horoscope data support and matching logic rather than image generation/output, the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code broadly matches the stated core purpose: it creates 5 pages of horoscope images for all 12 constellations using TianAPI data and social-media-oriented formatting. However, the description is not fully accurate. The script does more than image generation: it also writes a separate 发布文案.txt caption/posting copy file. It also depends on undeclared local resources, including config.json for API keys, local icon image files, and local pair-description/modules, so it is not solely a TianAPI-based generator. Finally, it materially modifies the retrieved fortune scores through normalize_scores(), reassigning rankings and percentages randomly, which means the output is not a straightforward rendering of TianAPI fortunes. These are meaningful behavior differences, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill creates 12 constellation fortune images using TianAPI and formats them into 5-page, large-font outputs for social media platforms. The supplied code does something materially different: it stores predefined compatibility descriptions for zodiac sign pairs and generates a randomized pairing result for two signs. It does not call TianAPI, does not generate fortunes, does not create images, and does not implement any pagination, typography, or social-media publishing formatting. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script presents itself as using API-provided horoscope data, but later includes logic to overwrite scores with randomized values. This is deceptive data manipulation: downstream users and publishers may believe the output is authentic when it has been intentionally altered, creating integrity and trust risks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script claims execution stops to preserve data authenticity if retrieval is incomplete, yet once full data is retrieved it deliberately modifies the fetched scores before generating content. This inconsistency is dangerous because it falsely signals integrity controls while still publishing manipulated results, which can mislead operators, users, or partner platforms.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The publish instructions use npx clawhub@latest login, which executes whatever code is currently published under that package version at runtime. Using @latest is a supply-chain risk because a compromised or malicious upstream release could run arbitrary code on the publisher's machine during login or publishing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The publish command uses npx clawhub@latest publish daily-horoscope, again pulling and executing the newest package version dynamically. In a release workflow this increases exposure to supply-chain compromise, since the command may run unreviewed code with access to local files, credentials, and publishing authority.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx clawhub@latest install daily-horoscope, which pulls and executes the latest package version rather than a pinned, reviewed release. Because npx executes fetched code, a compromised upstream package, malicious update, or supply-chain hijack could lead to arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This is a second occurrence of the same unsafe installation guidance in the English section. Recommending npx clawhub@latest increases supply-chain risk because users are told to execute whatever code is published as the latest version at install time, which can be exploited if the package or publishing pipeline is compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation describes capabilities that require file reads/writes and network access, but it does not declare any explicit tool scope or permissions. In agent environments, this creates an overbroad trust boundary where a user may invoke a skill without understanding what resources it can access, increasing the risk of unintended file or network operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description and core usage guidance are predominantly in Chinese, and the skill is positioned for Xiaohongshu, Douyin, and Toutiao specifically. Under the policy rule, forcing a specific language/locale without explicit user opt-in or a clearly documented justified locale constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx clawhub@latest installs and executes whatever version is currently published, which makes the supply chain non-deterministic and vulnerable to malicious or compromised upstream releases. A future package update could introduce unexpected code execution during installation or skill retrieval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

该文档标题及全文规范均以中文固定表述，没有说明是否允许其他语言版本或由用户选择输出语言。根据规则，若技能在自然语言层面强制特定语言且无用户选择或合理地域限定，属于政策风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language descriptions and outputs that are written exclusively in Chinese, and there is no indication that users can choose another language or opt in to this locale. That creates a language/locale policy concern because the skill effectively forces a specific language experience.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a skill for generating 12 constellation fortune images with TianAPI and social-media-oriented layout output. This module's documented and implemented responsibilities include a local pairing algorithm plus supplemental health, adversarial-sign, direction, and time data, which expand the skill from image generation into additional astrology-content generation not stated in the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The test/output strings shown to users at runtime are all hard-coded in Chinese, and the file provides no alternative language option or user opt-in. Per the policy, language constraints should either be optional or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This codebase uses Chinese-only natural-language descriptions and user-facing output throughout, beginning with the module docstring and continuing in generated content, but it does not provide opt-in language selection or explain that the skill is intentionally region- or locale-specific. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file defines the skill’s descriptions, comments, docstrings, and output strings entirely in Chinese, which effectively forces a single language experience. The policy allows locale constraints only when they are explicitly justified or when users are offered a language choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L13 states that the README must contain a bilingual Chinese and English introduction. This is a natural-language locale requirement, and the file does not explain that this is optional, user-selected, or justified by a region-specific compliance need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README tells users to copy a config file and place their TianAPI key in it, but provides no warning about keeping that file out of version control, restricting file permissions, or preferring environment-based secret management. In a skill intended for easy social-media content generation, less technical users may accidentally commit or share credentials, leading to API key leakage and unauthorized use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill output is presented only in Chinese, with no indication that language selection is optional or user-configurable. Under the policy scope for natural-language violations, forcing a specific language without opt-in can be considered a locale/language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This plain-text skill content is entirely written in Chinese and provides no indication that the language is optional, configurable, or limited to a China-specific audience. Under the policy rule for natural-language constraints, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest-style JSON file contains natural-language metadata in Chinese ("12星座符号映射表") while providing no indication that the skill is intentionally limited to a Chinese locale or that users can choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code file includes natural-language docstrings and comments exclusively in Chinese, such as the module description and function documentation. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.