风水大师助手2.7.0

天机·玄机子 - 结合传统风水命理智慧与现代AI技术的智能助手。提供八字命理分析、风水布局咨询、掌纹解读、易经占卜等传统智慧服务。当用户需要风水命理咨询、八字分析、掌纹解读、易经占卜、传统智慧学习指导时使用此技能。支持图像分析（掌纹、风水布局图）、文本咨询、专业书籍推荐、学习路径规划。

This skill is coherent with its stated function (it sends images to Volcengine and returns analysis), but exercise caution before installing: - Inspect your global OpenClaw config (~/.openclaw/openclaw.json). If it contains unrelated secrets (other API keys, tokens), move or clone only the required keys into a dedicated, minimal config for this skill, or set the OPENCLAW_CONFIG_PATH to a restricted file. - The skill will send Base64-encoded images to ark.cn-beijing.volces.com and any configured DeepSeek endpoint — do not upload images containing PII or sensitive documents. - Because the manifest does not declare required env vars, assume the code will read DOUBAO_API_KEY/DEEPSEEK_API_KEY/VOLCENGINE_API_KEY and potentially BAIDU_API_KEY via the bundled baidu-search subskill; provide least-privilege keys and consider usage quotas/monitoring. - Review the bundled Python scripts (already included) yourself or run the skill in a sandboxed/test environment before using on real data. - If you need to proceed, create a dedicated config file in the skill workspace with only the necessary public API key, set appropriate file permissions, and rotate keys after testing.

Type: OpenClaw Skill Name: tianji-fengshui Version: 2.7.0 The tianji-fengshui skill bundle is a comprehensive assistant for Feng Shui, palmistry, and Bazi analysis. It integrates with Doubao (Volcengine) and DeepSeek APIs for image and text processing. The code demonstrates security-conscious practices, such as implementing a path validation function (is_safe_file_path) in tianji_core_enhanced.py to prevent directory traversal and providing a security audit script (security_check_fixed.py) to help users identify hardcoded keys. While the skill reads the global OpenClaw configuration file (~/.openclaw/openclaw.json) to retrieve necessary API keys, this behavior is explicitly documented in SKILL.md and aligned with its stated purpose. No evidence of data exfiltration, unauthorized network calls, or malicious intent was found.