MysticX Tarot Drawer

Draw tarot cards from MysticX.ai — one card, daily card, or any of 13 spreads. Browse the full 78-card deck. No API key needed.

This skill simply calls a public MysticX API to fetch tarot cards and spreads and does not request any credentials or install software. Before installing, consider: (1) Any question or personal detail you include will be sent to mysticx.ai (the API echoes the question), so avoid sending sensitive PII. (2) The SKILL.md includes a homepage (https://mysticx.ai) but registry metadata omitted it — if provenance matters, verify the site and its privacy policy. (3) If you need offline/no-network operation for privacy, this skill is not suitable. Otherwise the skill appears coherent and proportionate to its stated purpose.

Type: OpenClaw Skill Name: mysticx-tarot-drawer Version: 1.1.1 The skill's instructions are primarily benign, directing the OpenClaw agent to interact with the mysticx.ai API for tarot card services. However, it instructs the agent to pass user-provided input directly into URL query parameters (e.g., `question`) and to render API-provided strings (e.g., `Card Name`, `imageUrl`) as markdown. These patterns, found in SKILL.md, introduce potential vulnerabilities such as URL injection or markdown injection if the OpenClaw agent does not adequately sanitize or encode user input and API responses before making requests or rendering output. While there is no evidence of intentional malicious behavior, these risky capabilities warrant a 'suspicious' classification due to the potential for exploitation.