塔罗牌占卜

塔罗牌占卜付费服务，每日为你抽取一张塔罗牌，解读牌意与运势指引。包含78张塔罗牌数据（大阿尔卡纳22张 + 小阿尔卡纳56张），每次占卜随机抽取一张牌，给你牌意解读和今日指引。

This skill is not obviously exfiltrating data or making network calls, but there are several red flags you should address before using it: 1) Replace configs/config.yaml values (crypto.sm4_key and payment.pay_to) with your own secret and account — the repo includes defaults that would direct payments/encrypted data to someone else. 2) Confirm the actual payment flow: the README says to use 'clawtip' to pay, but the scripts expect a payCredential inside the saved order JSON; verify how clawtip returns or injects that credential and whether that process is secure. 3) Fix the path mismatch: SKILL.md expects ~/.hermes/skills/塔罗牌占卜 but the code loads config from ~/.hermes/skills/skill-factory; ensure config and data files are in the path the scripts actually read. 4) Audit dependencies: the code uses the cryptography library and SM4; ensure you install a trusted cryptography package and verify it implements SM4 correctly. 5) Review the default pay_to string and key offline (don't use the default) and test the skill in a controlled environment (no real payments) until you understand the payment credential lifecycle. If the author provides documentation about how clawtip writes payCredential back to the order files or supplies an updated config with placeholders instead of real account data, that would increase confidence.

Type: OpenClaw Skill Name: tarot-divination Version: 1.0.0 The tarot-divination skill implements a functional tarot reading service with a built-in micro-payment (1 cent) workflow. It uses standard SM4 encryption (sm4_utils.py) to secure order data and SQLite (file_utils.py) for local order tracking. The code logic in create_order.py and serve.py aligns perfectly with the stated purpose in SKILL.md, and no indicators of data exfiltration, unauthorized execution, or malicious intent were found. While there is a minor path discrepancy in file_utils.py (referencing a 'skill-factory' directory), it appears to be a non-malicious configuration oversight.