← 返回 Skills 市场

Bytesagain Fortune Teller

Name: Bytesagain Fortune Teller
Author: loutai0307-prog

作者 loutai0307-prog · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install bytesagain-fortune-teller

功能描述

Draw tarot cards, cast I Ching hexagrams, and check daily fortunes for fun. Use when pulling spreads, casting hexagrams, or playing fortune games.

使用说明 (SKILL.md)

Fortune Teller

算命娱乐。塔罗牌、易经占卜、每日运程、缘分测试、数字命理、手相(娱乐)。Fortune teller for fun with tarot, I Ching. 算命、塔罗、占卜、娱乐。

使用场景

💡 无论你是新手还是专业人士，都能快速上手

命令速查

  tarot           tarot
  iching          iching
  daily           daily
  compatibility   compatibility
  numerology      numerology
  palmistry       palmistry

Fortune Teller by BytesAgain

💬 Feedback & Feature Requests: https://bytesagain.com/feedback Powered by BytesAgain | bytesagain.com

Run fortune-teller help for commands
No API keys needed
Run fortune-teller help for all commands

Commands

Run fortune-teller help to see all available commands.

Output

Results go to stdout. Save with fortune-teller run > output.txt.

Configuration

Set FORTUNE_TELLER_DIR to change data directory. Default: ~/.local/share/fortune-teller/

安全使用建议

This skill appears to do what it says: local, offline fortune-telling. Before installing or running it, note that it will create a directory (default ~/.local/share/fortune-teller) and write history.log and data.log which may contain any text you add (so avoid entering secrets). There are no network calls or required API keys. If you prefer isolation, set FORTUNE_TELLER_DIR to a sandbox folder or inspect the scripts locally before running. Also be aware SKILL.md references a 'fortune-teller' command but no install step is provided — you may need to place the included scripts on your PATH or run them directly.

功能分析

Type: OpenClaw Skill Name: bytesagain-fortune-teller Version: 1.0.0 The skill contains multiple shell injection vulnerabilities in 'scripts/fortune.sh' and 'scripts/script.sh' due to unquoted variable expansion (e.g., '$INPUT' and '$*'). These flaws could allow arbitrary command execution if the agent passes unsanitized input to commands like 'bazi', 'add', or 'search'. While the code appears to be a legitimate fortune-telling utility and lacks evidence of intentional malice or data exfiltration, the high-risk nature of these vulnerabilities warrants a suspicious classification.

能力评估

✓ Purpose & Capability

Name/description (tarot, I Ching, daily fortunes) match the included scripts. The two scripts implement fortune commands (bazi, daily, zodiac) and a small local data CLI (run/add/list/search). No unrelated credentials or binaries are requested.

ℹ Instruction Scope

SKILL.md directs users to run the CLI and mentions FORTUNE_TELLER_DIR. The runtime scripts read standard env vars (XDG_DATA_HOME, HOME) and write to a data directory. They log user actions to history.log and append entries to data.log — so user inputs may be stored locally. There are no network calls or instructions to read other system files.

✓ Install Mechanism

No install spec (instruction-only). The package includes plain shell scripts and an inline Python invocation. Nothing is downloaded or extracted from remote URLs during install.

✓ Credentials

The skill declares no required env vars or credentials. At runtime the scripts consult FORTUNE_TELLER_DIR (optional), XDG_DATA_HOME, and HOME — all reasonable for configuring a local data directory.

ℹ Persistence & Privilege

The scripts create and write files under the user's data directory (default ~/.local/share/fortune-teller) including data.log and history.log. always:false and no elevated privileges are requested. Persistence is limited to the skill's own data directory.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install bytesagain-fortune-teller
安装完成后，直接呼叫该 Skill 的名称或使用 /bytesagain-fortune-teller 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Restored with improvements

元数据

Slug bytesagain-fortune-teller

版本 1.0.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 1

常见问题