← Back to Skills Marketplace
792
Downloads
0
Stars
1
Active Installs
4
Versions
Install in OpenClaw
/install zodiac-horoscope
Description
Fetch personalized daily horoscope forecasts from zodiac-today.com API based on natal chart calculations. Use when a user wants: (1) daily guidance on what a...
Usage Guidance
Before installing: (1) note the manifest mismatch — SKILL.md requires ZODIAC_API_KEY and ZODIAC_PROFILE_ID but the registry metadata doesn't declare them; ask the publisher to correct the metadata. (2) This skill will ask for sensitive PII (email, birth date, birth city) — only collect with explicit consent and store/delete data securely. (3) The runtime doc suggests the agent can automatically read verification emails via IMAP; avoid granting mailbox/IMAP access unless you trust the skill and operator — prefer a manual code-entry workflow. (4) Keep the API key and profile ID in a dedicated, least-privilege environment (or ephemeral secrets), and delete temporary cookie files as instructed. (5) Because this is instruction-only, there was no code to scan; that reduces evidence about hidden behavior — if you need higher assurance, request a signed author/source and a manifest update listing the required env vars and exact scopes (email access, cookie storage).
Capability Analysis
Type: OpenClaw Skill
Name: zodiac-horoscope
Version: 1.3.0
The skill is classified as suspicious primarily due to the instruction in `SKILL.md` that suggests the AI agent may retrieve a verification code automatically from the user's email via IMAP if it has access. While the stated purpose is to automate a legitimate setup step for the `zodiac-today.com` service, instructing an agent to access a user's email inbox, even for a specific email and code, represents a high-risk capability. This capability, if combined with broad agent permissions or misinterpretation, could lead to unintended privacy breaches, making it a risky design choice rather than clearly malicious intent.
Capability Assessment
Purpose & Capability
The skill's stated purpose (fetch personalized horoscopes from zodiac-today.com) legitimately requires an API key and a profile ID and may require user birth data — so the runtime requirements in SKILL.md are coherent with the purpose. However, the registry metadata lists no required environment variables or primary credential while SKILL.md explicitly requires ZODIAC_API_KEY and ZODIAC_PROFILE_ID; that registry/manifest mismatch is an integrity concern.
Instruction Scope
The SKILL.md instructs the agent to collect sensitive PII (email, birth date, birth city) and explicitly says it may automatically retrieve the verification code 'if the agent has email access (e.g., IMAP)'. That broadens scope to mailbox access (not declared elsewhere) and instructs writing a session cookie file (cookies.txt). Although the doc asks for user consent and to delete cookies.txt, it still directs behaviors (email/IMAP access, temporary cookie storage) that go beyond simple API calls and may require additional privileges the registry doesn't declare.
Install Mechanism
This is instruction-only with no install spec and no code files — minimal install surface and nothing is written to disk by an installer. The only file operation noted is a temporary cookies.txt created by curl in the documented workflow; that is explicitly described and meant to be deleted.
Credentials
SKILL.md requires two environment values (ZODIAC_API_KEY and ZODIAC_PROFILE_ID) which are proportional to the API integration. But the registry metadata lists none — a mismatch that could hide required secrets. The skill also requires collection of sensitive PII for natal chart calculations; collecting this data is explainable for the feature but increases privacy risk and requires explicit consent and secure handling. The instructions also mention session cookies and possible automated email access, which implies access to credentials or mailboxes not declared in manifest.
Persistence & Privilege
The skill is not forced-always and is user-invocable; autonomous model invocation remains permitted (the default). The main privilege concern is the instruction to access the user's email (IMAP) to retrieve verification codes — combined with autonomous invocation this could increase blast radius. There is no install-time persistence or system-level privilege escalation requested in the files provided.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install zodiac-horoscope - After installation, invoke the skill by name or use
/zodiac-horoscope - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.3.0
Fixed metadata mismatch: moved env var declarations into description for registry visibility. Clarified human-in-the-loop email verification, secure cookie handling, and PII consent flow.
v1.2.0
Declared required env vars (ZODIAC_API_KEY, ZODIAC_PROFILE_ID); added PII privacy notice for birth data
v1.1.0
Added registration and API key setup workflow via API (no browser needed)
v1.0.0
Initial release: personalized daily horoscope forecasts from zodiac-today.com API
Metadata
Frequently Asked Questions
What is Zodiac Horoscope?
Fetch personalized daily horoscope forecasts from zodiac-today.com API based on natal chart calculations. Use when a user wants: (1) daily guidance on what a... It is an AI Agent Skill for Claude Code / OpenClaw, with 792 downloads so far.
How do I install Zodiac Horoscope?
Run "/install zodiac-horoscope" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Zodiac Horoscope free?
Yes, Zodiac Horoscope is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Zodiac Horoscope support?
Zodiac Horoscope is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Zodiac Horoscope?
It is built and maintained by dowands (@dowands); the current version is v1.3.0.
More Skills