AsianSeeker - Openclaw FortuneTeller

Mingli (命理) — Multi-system daily horoscope: Western astrology (natal chart + transits), Ba-Zi / Four Pillars (Bát Tự), numerology, I Ching (Kinh Dịch). Kerykeion + astronomyapi.com. Telegram delivery.

Key things to check before installing: - Metadata mismatch: the registry claims no env vars/config paths but the scripts require ASTRONOMY_APP_ID and ASTRONOMY_APP_SECRET. If you plan to use transit data, you must provide these secrets. Verify where and how you will store them and whether the agent actually needs them. - Persistent state & cron jobs: the skill writes user PII (birth date/time, lat/lon, LifePath number, Telegram chat IDs) to ~/clawd/memory/horoscope-users.md and state/users.json and creates cron jobs that send messages to Telegram. Make sure you are comfortable with those files being created in your home directory and with scheduled outgoing messages. Consider where those files will live, whether they are readable by others, and whether you want to allow the skill to create cron jobs. - Telegram delivery: the skill expects to send messages to Telegram chat IDs. Confirm the integration uses trusted, platform-managed telegram_actions (do not paste your Telegram bot token into skill files) and verify what permissions the Telegram channel/ bot uses. - Path/prompt incoherence: references/horoscope-prompt-template.md calls a script under .claude/skills/daily-horoscope/... while other examples use .claude/skills/mingli/.... That mismatch suggests the runtime prompt or examples may be broken or cause the agent to look in unexpected locations. Ask the author to fix the paths. - Third-party packages: kerykeion (pip) is required for full natal-chart calculations. Verify the package's provenance (PyPI page, maintainers) before allowing pip install. - Minimal test: run the included scripts locally with test data and without supplying ASTRONOMY credentials to confirm fallback behavior. Check what files are created and what exact network calls are made (fetch-planetary-positions.py uses astronomyapi.com only). - If privacy is a concern, do not grant autonomous invocation or cron-creation rights until you review/modify the code to store data in an approved secure location, or to require explicit user approval per operation. If you want, I can produce a short checklist / patch suggestions to (a) declare required env vars in the skill metadata, (b) fix the path typo in the prompt template, and (c) change where and how memory is stored (or make it configurable).

Type: OpenClaw Skill Name: mingli Version: 1.0.2 The skill is classified as suspicious due to its use of several high-risk capabilities, even though they appear to align with the stated purpose. Specifically, the `scripts/fetch-planetary-positions.py` script reads environment variables (`ASTRONOMY_APP_ID`, `ASTRONOMY_APP_SECRET`) for external API authentication and performs network calls to `astronomyapi.com`. Additionally, the `SKILL.md` instructions detail the creation and management of cron jobs for daily horoscope delivery, which is a form of persistence. While these actions are plausibly necessary for the skill's functionality (multi-system horoscope with Telegram delivery), they represent significant capabilities that could be misused if the skill's intent were malicious.