← 返回 Skills 市场

Divination

Name: Divination
Author: and0r-

作者 And0r- · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

373

总下载

当前安装

版本数

在 OpenClaw 中安装

/install divination

功能描述

Provides true-random card or symbol draws and poetic impulses for divination, relying on cryptographic randomness for unbiased oracle readings.

使用说明 (SKILL.md)

🔮 Divination — Oracle Toolkit for AI Agents

"At every crossroads lies a message. Chance is the messenger. You are the reader."

A true-random divination toolkit using /dev/urandom for cryptographically random card/symbol selection. Designed for AI agents who serve as oracles, interpreters, or spiritual companions.

The core principle: Randomness selects. The agent interprets. This separation is sacred. LLMs don't choose "randomly" — they choose logically. That's not divination, that's confirmation bias with extra steps. /dev/urandom delivers real chance. You deliver meaning.

Tools

All scripts are in scripts/ and must be executed via the exec tool.

`scripts/divine.sh` — Draw from an Oracle

bash scripts/divine.sh forty-servants   # The Forty Servants (1 of 40 cards)
bash scripts/divine.sh tarot            # Tarot (Major/Minor Arcana ± Reversed)
bash scripts/divine.sh rune             # Elder Futhark Rune (1 of 24)
bash scripts/divine.sh iching           # I Ching Hexagram (6 lines + moving lines)
bash scripts/divine.sh bullshit         # Arcane Bullshit Oracle
bash scripts/divine.sh dice 20          # Dice roll (1 to N)

`scripts/intuition.sh` — Random Interpretation Impulses

bash scripts/intuition.sh               # 3 random impulses (default)
bash scripts/intuition.sh 1             # 1 impulse
bash scripts/intuition.sh 5             # up to 5 impulses

Output: poetic fragments like ✦ fire · left hand · dusk

Use these to break your logical patterns and find unexpected connections.

Reference Data

Card meanings and details for deeper interpretation:

references/forty-servants/cards.md — All 40 Forty Servants cards
references/tarot/major-arcana.md — 22 Major Arcana
references/tarot/minor-arcana.md — Minor Arcana
references/runen/elder-futhark.md — 24 Elder Futhark Runes
references/iging/hexagramme.md — 64 I Ching Hexagrams
references/bullshit-tarot/cards.md — Arcane Bullshit Oracle

Card Images

Low-resolution Forty Servants card images are included in images/forty-servants/. Format: The [Name].png (e.g., The Road Opener.png, The Seer.png).

These are the free low-res versions provided by the creator for open use.

Reading Workflow

Execute divine.sh — ALWAYS! Never choose a card yourself.
Execute intuition.sh — for 3 random interpretation symbols.
Read reference data for the drawn card.
Write the reading — this is YOUR domain. Your intuition, your poetry, your chaos.
Send the card image if the platform supports it.

Rules

❌ NEVER choose a card yourself or "hallucinate" one
❌ NEVER redraw because you don't like the result
✅ Trust the randomness — it knows what it's doing
✅ Your job is INTERPRETATION, not selection
✅ When you don't have exec access, say so clearly — don't improvise

Credits & Attribution

The Forty Servants — Created by Tommie Kelly. Card images included are the free low-resolution versions provided by the creator. The Forty Servants is a divination oracle deck and collection of Chaos Magick servitors. Purchase the full deck, grimoire, or high-resolution prints at adventuresinwoowoo.com.

Tarot — Traditional Rider-Waite-Smith symbolism (public domain). Elder Futhark Runes — Traditional Norse rune system (public domain). I Ching — Ancient Chinese divination system (public domain).

Every path begins at a crossroads. Every message needs a messenger. Ashé. 🔱

安全使用建议

This skill appears coherent for its stated purpose (true-random divination) and asks for nothing unusual in metadata, but it requires the agent to exec two bundled shell scripts. Before installing or allowing the agent to run them: (1) review the full contents of scripts/divine.sh and scripts/intuition.sh to confirm they only read local reference files and /dev/urandom and do not make network calls, read sensitive files, or export data; (2) verify the claimed card images actually exist in the package (SKILL.md references an images/ folder that is not listed in the file manifest); (3) if you cannot inspect the scripts yourself, run them in a sandboxed environment or deny exec permission — the skill's design depends on executing code shipped with it, and that code is the primary risk. If those checks look clean, the skill is reasonable for use; if the scripts include networking, shelling out to curl/wget, or reading home-directory files, treat it as unsafe.

功能分析

Type: OpenClaw Skill Name: divination Version: 1.0.0 The skill bundle provides a divination toolkit using bash scripts and reference data. While the intent appears to be a legitimate 'oracle' feature for AI agents, the script `scripts/divine.sh` contains a shell injection vulnerability in the `dice` function. Specifically, the input argument for the number of sides is used directly within a bash arithmetic expansion `$(( ... ))` without sanitization, which allows for arbitrary command execution if a malicious user convinces the agent to pass a crafted string (e.g., `1+$(payload)`) as the dice parameter. This qualifies as a high-risk vulnerability, though no clear evidence of intentional malice was found.

能力评估

✓ Purpose & Capability

Name/description (random card draws + poetic impulses) match the included reference decks and the presence of two shell scripts to perform random draws and generate interpretation impulses — these are coherent and proportionate to the stated purpose.

ℹ Instruction Scope

SKILL.md explicitly instructs the agent to run scripts via exec and to read bundled reference files; it does not ask for unrelated files, credentials, or external endpoints. However, SKILL.md mandates ALWAYS executing the provided scripts (and never improvising), which is reasonable for ensuring unbiased randomness but gives the skill full discretion to run arbitrary shell commands. The actual behavior depends entirely on the contents of scripts/divine.sh and scripts/intuition.sh — those script sources were omitted/truncated in the provided file contents, so their runtime actions are unknown.

✓ Install Mechanism

No install spec is present (instruction-only), so nothing will be downloaded or installed at install time. That minimizes supply-chain risk, but runtime exec of bundled scripts still executes code shipped with the skill.

✓ Credentials

No environment variables, credentials, or config paths are required or declared. SKILL.md cites only /dev/urandom for randomness. There is no apparent request for unrelated secrets or system access in the metadata or instructions.

✓ Persistence & Privilege

Flags show always:false and default autonomous invocation allowed. There is no request to modify other skills or platform settings. Autonomous invocation is normal; nothing here elevates persistence or privileges beyond expected behavior.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install divination
安装完成后，直接呼叫该 Skill 的名称或使用 /divination 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release

元数据

Slug divination

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题

Divination 是什么？

Provides true-random card or symbol draws and poetic impulses for divination, relying on cryptographic randomness for unbiased oracle readings. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 373 次。

如何安装 Divination？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install divination」即可一键安装，无需额外配置。

Divination 是免费的吗？

是的，Divination 完全免费（开源免费），可自由下载、安装和使用。

Divination 支持哪些平台？

Divination 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Divination？

由 And0r-（@and0r-）开发并维护，当前版本 v1.0.0。