太乙神数技能

太乙神数排盘技能。支持太乙积年、起局、排十六神将、计算主客算、断局分析。用于国运预测、天灾预警、经济大势、战争胜负等宏观预测。

Do not install or run this skill as-is. Key issues to resolve before trusting it: 1) SKILL.md commands run a Python script (~/.openclaw/skills/taiyi-skill/scripts/taiyi_pan.py) that is missing from the package — ask the author to include the Python script or update the docs to explain how index.js is intended to be used. 2) The included index.js contains multiple clear bugs and inconsistencies (bad/mismatched function calls, object literals and punctuation using fullwidth/non-ASCII colons/commas, functions expecting different parameters, and logic that treats arrays as strings). These will cause runtime errors or unexpected behavior. 3) Verify the claimed GitHub repository and obtain a corrected, versioned release with matching language (Python vs Node), a clear install/run README, and preferably tests or example runs. 4) Because the SKILL.md references running a script from your home directory, be cautious: scripts run from your home can read/write user files — confirm the script only accesses its own files and does not exfiltrate data. 5) The good news: there are no declared credentials, no network endpoints in the code, and no installer that fetches remote code; the primary risk here is broken/incomplete code rather than obvious exfiltration, but broken code can still cause harm (data overwrite, unexpected file IO). If you want to proceed safely: request a fixed package (matching language and files), review the script source before running, and test it inside an isolated sandbox/container rather than on a production machine.

Type: OpenClaw Skill Name: taiyi-skill Version: 2.0.0 The skill bundle provides a divination tool (Taiyi Shenshu) for macro-level predictions. While the core logic in `index.js` is algorithmic and benign, the `SKILL.md` instructions introduce a significant security vulnerability by directing the AI agent to execute shell commands (`taiyi_pan.py`) using unvalidated user-provided arguments such as `--date` and `--question`. This pattern creates a high risk of shell injection, as a malicious user could provide input designed to escape the command string and execute arbitrary code on the host system. Additionally, there is a functional inconsistency between the provided JavaScript implementation and the Python-based execution model described in the documentation.