MeiHuaYi

梅花易数卜卦系统。 支持时间起卦、数字起卦。 自动排盘并进行分析，梅花易理进行推断。

This skill appears to be what it claims: a local MeiHuaYi divination tool that logs each session for later review/learning. Before installing or running, consider: (1) Privacy: the skill will save full questions, the entire reasoning chain and conclusions to SQLite files under the skill's data/ directory—these may contain sensitive personal details you provide. If you don't want persistent logs, remove or relocate the data/ files or modify the code that calls save_record/add_feedback/add_note. (2) Network fetch: meihuayi.py will try to download iching.json from a GitHub raw URL if the bundled copy is missing—if you require fully offline operation, ensure data/iching.json is present before running or block network access. (3) Code review: all behavior is in plain Python (no obfuscation, no remote code execution beyond the JSON fetch); you can inspect meihuayi.py, records.py and learning_notes.py before use. (4) Sandboxing: run in a restricted environment if you are concerned about data retention or outbound network access. If you want, I can point to the exact lines that perform database writes and the network download so you can patch or audit them.

Type: OpenClaw Skill Name: meihuayi Version: 1.0.5 The bundle implements a traditional Chinese divination system with local SQLite database management for records and AI 'learning notes.' It is classified as suspicious primarily due to a remote network call in meihuayi.py that automatically downloads a JSON data file from a GitHub repository (raw.githubusercontent.com) if it is missing. While this is plausibly needed for the skill's functionality, the execution of remote artifacts and the highly prescriptive instructions in SKILL.md—which mandate specific AI behaviors like mandatory data logging and structured output—represent a potential attack surface and a risky capability.