Skills/ClawHub/astro-lunar-insights

astro-lunar-insights@1.3.3

VERIFIED· install only

Publisher claims: "Calculates precise lunar phases, Moon transits, aspects to natal planets, lunar days, and personal solar-lunar phases with charts and text analysis." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dynamicsalex · publishing for 162 daysInstalls 1,319Last detonated 2d ago
$clawhub install astro-lunar-insights
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Unicode escape sequence detectedscripts/draw_lunar.py:543 · Unicode escape sequence detected — may contain obfuscated payloadsT7 = '\u0421\u041a\u041e\u0420\u041e\u0421\u0422\u042c \u041b\u0423\u041d\u042b'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/draw_lunar.py:538 · Unicode escape sequence detected — may contain obfuscated payloadsT2 = '\u0411\u041b\u0418\u0416\u0410\u0419\u0428\u0418\u0415 \u0424\u0410\u0417\u042b'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/draw_lunar.py:539 · Unicode escape sequence detected — may contain obfuscated payloadsT3 = '\u041b\u0423\u041d\u041d\u042b\u0419 \u0414\u0415\u041d\u042c'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/lunar_analysis.py:192 · Unicode escape sequence detected — may contain obfuscated payloads'\u043c\u043e\u0441\u043a\u0432\u0430': (55.75, 37.62),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedscripts/draw_lunar.py:931 · Python subprocess execution detectedres = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedscripts/lunar_analysis.py:193 · Unicode escape sequence detected — may contain obfuscated payloads'\u0441\u0430\u043d\u043a\u0442-\u043f\u0435\u0442\u0435\u0440\u0431\u0443\u0440\u0433': (59.93, 30.32),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/lunar_analysis.py:313 · Unicode escape sequence detected — may contain obfuscated payloads… move quickly, less depth" if lang != 'ru' else "\u041e\u0447\u0435\u043d\u044c \u0431\u044b\u0441\u0442\u0440\u0430\u044f (\u0440\u044f\u0434\u043e\u043c \u0441 \u043f\u0435\u0440\u0438\u0433\u0435\u04…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionSKILL.md:376 · File type combined with upload action — agent may exfiltrate local data files…NIOENCODING=utf-8`. **Solution:** `lunar_analysis.py` supports `--output file.json` which writes JSON directly to a file via `open(..., encoding='utf-8')`, completely bypassing the console. `draw_lunar.py` uses this internally — it passes …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/draw_lunar.py:540 · Unicode escape sequence detected — may contain obfuscated payloadsT4 = '\u041b\u0423\u041d\u0410 \u041a \u041d\u0410\u0422\u0410\u041b\u042c\u041d\u041e\u0419'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/draw_lunar.py:541 · Unicode escape sequence detected — may contain obfuscated payloadsT5 = '\u041f\u0415\u0420\u0421\u041e\u041d\u0410\u041b\u042c\u041d\u0410\u042f \u0424\u0410\u0417\u0410'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈5,803 tok
1 file · 7 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.