Zodiac Horoscope

Fetch personalized daily horoscope forecasts from zodiac-today.com API based on natal chart calculations. Use when a user wants: (1) daily guidance on what a...

Before installing: (1) note the manifest mismatch — SKILL.md requires ZODIAC_API_KEY and ZODIAC_PROFILE_ID but the registry metadata doesn't declare them; ask the publisher to correct the metadata. (2) This skill will ask for sensitive PII (email, birth date, birth city) — only collect with explicit consent and store/delete data securely. (3) The runtime doc suggests the agent can automatically read verification emails via IMAP; avoid granting mailbox/IMAP access unless you trust the skill and operator — prefer a manual code-entry workflow. (4) Keep the API key and profile ID in a dedicated, least-privilege environment (or ephemeral secrets), and delete temporary cookie files as instructed. (5) Because this is instruction-only, there was no code to scan; that reduces evidence about hidden behavior — if you need higher assurance, request a signed author/source and a manifest update listing the required env vars and exact scopes (email access, cookie storage).

Type: OpenClaw Skill Name: zodiac-horoscope Version: 1.3.0 The skill is classified as suspicious primarily due to the instruction in `SKILL.md` that suggests the AI agent may retrieve a verification code automatically from the user's email via IMAP if it has access. While the stated purpose is to automate a legitimate setup step for the `zodiac-today.com` service, instructing an agent to access a user's email inbox, even for a specific email and code, represents a high-risk capability. This capability, if combined with broad agent permissions or misinterpretation, could lead to unintended privacy breaches, making it a risky design choice rather than clearly malicious intent.