紫微斗数合盘配对

紫微斗数双人合盘：先以 zwds-cli 各排一盘，再将两份 data 送入 hepan-cli 得 0–100 匹配分、维度分项与 hits。用户提及合盘、配对、缘分指数、双人紫微匹配时使用。

This skill appears coherent and local: it loads rules/tables from bundled files and computes scores from two zwds-cli JSON outputs, without network calls or secret collection. Before installing, ensure you have Node.js >=18 and the expected repository layout (openclaw-skill/zwds/zwds-cli and openclaw-skill/zwds-hepan/hepan-cli) so the SKILL.md commands run correctly. The skill processes potentially sensitive personal birth data (birth time/place) — consider privacy implications before sending real user data to an agent that may invoke the skill. Also note the SKILL.md assumes zwds-cli is available and that npm ci has been run there; if you cannot provide that dependency, the skill will fail. Finally, while this evaluation found no incoherence or external exfiltration indicators, keep standard caution about running third-party code locally and review the code if you require higher assurance.

Type: OpenClaw Skill Name: zwds-hepan-openclaw Version: 1.0.0 The skill bundle contains a path traversal vulnerability in `hepan-cli/src/engine/computeCompat.js` within the `loadRulePack` function. This function constructs a file path using the user-provided `rule_version` parameter without proper sanitization, allowing the AI agent (and potentially an attacker via prompt injection) to read arbitrary `.json` files on the system. While the code appears to be a legitimate implementation of Zi Wei Dou Shu astrological compatibility and lacks clear evidence of intentional malice, this vulnerability represents a significant security risk.