ClawHub
Back to skill

Security audit

Yi Jing

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a divination guide, but it also gives concrete ritual and health-related instructions that users could mistake for medical guidance.

Review carefully before installing. Treat this as entertainment/cultural material only, do not use it for medical, mental-health, emergency, dietary, medication, or postoperative decisions, and avoid entering identifiable birth details unless necessary. If using the calendar code, approve and isolate any package installation yourself.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/calendar_time.md:320
Finding

Unpinned Third-Party Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: references/calendar_time.md, lines 320–325
Vulnerability Type: Unpinned package installation from a public package repository
Risk Level: Medium

Vulnerable Code

python
# pip install lunarcalendar

from lunarcalendar import Converter

Technical Analysis

The reference directs the agent or user to install lunarcalendar without specifying an approved version, cryptographic hash, lockfile, or trusted package index. Consequently, package resolution may select whichever release is current at installation time rather than the release originally reviewed.

Python packages can execute code during installation and whenever imported. If the package name, maintainer account, distribution channel, or a future release were compromised, the installed payload could execute with the privileges of the agent or user running pip and Python.

No evidence establishes that the current lunarcalendar package is malicious. The vulnerability is the uncontrolled supply-chain trust introduced by the installation instruction.

Attack Path

  1. A user requests lunar-calendar or sexagenary-cycle conversion.
  2. The agent consults references/calendar_time.md.
  3. The agent or user follows the unpinned pip install lunarcalendar instruction.
  4. The package manager retrieves the current package and transitive dependencies from its configured index.
  5. A compromised, substituted, or malicious future package release executes code during installation or import.
  6. The payload operates with the permissions available to the Python process.

Impact Assessment

Successful exploitation could allow arbitrary code execution within the agent's Python environment. The accessible scope would depend on the runtime sandbox and could include:

  • Reading or modifying files accessible to the installing user.
  • Accessing environment variables and process-level secrets.
  • Making network requests when outbound access is permitted.

...[truncated 295 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed version using an exact version constraint.
  2. Maintain a lockfile containing all resolved transitive dependency versions.
  3. Require package hashes and install with hash verification enabled.
  4. Use an explicitly configured, trusted package index or an internally reviewed mirror.
  5. Require explicit user approval before installing any package.
  6. Install dependencies in an isolated, least-privileged virtual environment or container.
  7. Remove network and sensitive-file access from the conversion runtime where possible.
  8. Prefer audited, vendored conversion logic if the dependency is small enough to maintain safely.
  9. Add documented verification and update procedures so dependency changes receive security review.

other

Warning
Location
SKILL.md:605
Finding

Unsupported Medical Guidance Derived from Divination

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 605–645 and 690–693
Vulnerability Type: Unsafe medical guidance
Risk Level: Medium

Vulnerable Instructions

The following is a faithful English rendering of the relevant Skill directives:

text
4. Organ symbolism:
   Provide health warnings by mapping the body parts associated with
   the five-element classification of the primary trigram.

Health hazard:
   Determine affected body parts from trigrams such as Water or Fire.

Fifth Star — Diet:
   Recommended: specific foods
   Prohibited: specific foods

Sixth Star — Resolution Plan:
   If there is a health warning, provide specific conditioning advice.

The problem diagnosis must be specific.
The resolution strategy must be actionable.
High-risk periods must be marked as absolute prohibition zones,
using severe language.

Technical Analysis

The Skill requires the model to infer health hazards and affected organs from divination symbols rather than medical evidence. It further requires specific dietary restrictions, health-conditioning advice, actionable remedies, and forceful statements about absolute high-risk periods.

These directives can produce individualized health claims that appear authoritative despite lacking clinical history, examination, diagnostic testing, medication review, or evidence-based assessment. The general entertainment and physician disclaimers elsewhere in the project reduce but do not eliminate the risk because the mandatory deep-analysis instructions still demand concrete diagnoses and actions.

Attack Path

  1. A user requests a divination reading, potentially about health or a general life concern.
  2. The Skill maps a trigram or five-element classification to particular organs or health hazards.
  3. The mandatory deep-analysis workflow produces a specific health-risk diagnosis.
  4. The Skill recommends particular foods, prohibited foods, conditioning measures, or periods of absolute prohibition. ...[truncated 939 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all requirements to diagnose health hazards or identify affected organs from divination symbols.
  2. Prohibit individualized dietary restrictions, treatment suggestions, and health-conditioning plans based on divination.
  3. Remove mandatory “absolute prohibition” language and instructions to use a severe tone.
  4. Restrict health-related output to neutral cultural or historical explanations.
  5. State clearly that divination cannot assess, diagnose, prevent, or treat medical conditions.
  6. When a user reports symptoms or health concerns, recommend assessment by an appropriately qualified healthcare professional.
  7. Include emergency guidance for potentially urgent symptoms without attempting to diagnose the cause.
  8. Avoid advice that could alter medication, treatment, nutrition, or clinical follow-up.
  9. Add automated tests ensuring that the Skill does not generate organ-specific diagnoses or medical prescriptions from trigram data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (68)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The case studies claim ritual intervention led to recovery from postoperative coma and pediatric nighttime symptoms, providing testimonial-style efficacy claims for medical outcomes. This is especially dangerous in an entertainment divination skill because success narratives can strongly persuade users to delay emergency care for unconscious patients or children.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section gives step-by-step ritual instructions for a patient described as post-gastrectomy, recently comatose, emotionally unresponsive, and possibly 'possessed,' with predicted recovery effects. Providing actionable non-medical procedures for an acute postoperative patient without an immediate directive to defer to clinicians is dangerous because caregivers may substitute superstition for urgent medical evaluation or misinterpret serious neurological or psychiatric symptoms.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough to match ordinary user requests, increasing the chance that the divination skill activates when the user did not explicitly intend to use it. In an agent environment, unintended invocation can cause irrelevant behavior, over-collection of personal data for fortune-telling flows, or routing into high-risk occult/medical/advice content without clear consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

High-collision terms like '算命', '占卜', and especially generic terms such as '古籍/经典' are likely to appear in normal conversation, making accidental activation and misrouting probable. Because this skill covers sensitive topics including health, fate, rituals, and occult remediation, broad activation increases the risk of unrequested harmful or manipulative advice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Automatic routing based on loosely described needs, without strict trigger constraints, allows the model to self-select files and capabilities far beyond the user's explicit request. In this skill, that can expand a benign query into occult diagnosis, life advice, or ritual-related content, increasing both unintended invocation and unsafe scope escalation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document forces a single language for all instructions and safety guidance, and there is no statement that the skill is region-specific or that users may choose another language. This can violate language or locale policy when users are not given opt-in or alternatives.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This content presents a ritual artifact as applicable to medical-like symptoms such as insomnia, altered mental status, and postoperative coma, which exceeds the skill's stated entertainment/divination purpose. Even with later disclaimers, framing a ritual as relevant to acute or psychiatric symptoms can delay appropriate medical care or encourage caregivers to substitute superstition for urgent treatment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The symptom table and '王兵案例适配' section operationalize the ritual as a treatment selection guide for serious conditions, including behavior changes, suspected possession, and postsurgical unresponsiveness. In context, this makes the skill more dangerous because it is packaged as a usable decision aid rather than mere folklore, increasing the chance users apply it in lieu of evidence-based intervention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template explicitly asks for a person's name, birth date/time, and age to perform fortune analysis, which are sensitive personal data points that can enable profiling, re-identification, and misuse if collected or retained without clear privacy guidance. In this skill context, the risk is heightened because birth-based divination inherently encourages users to submit precise identity-linked data, yet the file provides no minimization, consent, retention, or handling warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The template directs collection and display of sensitive personal data such as name, birth date/time, and derived age, but provides no privacy notice, minimization guidance, or handling restrictions. In an agent setting, this increases the risk of unnecessary retention, exposure in logs, or over-collection of personal information beyond what is strictly needed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file explicitly corrects the 命卦体用 rule earlier to '无动爻为体，有动爻为用', but the standard output template later reverses it by stating '体卦：动爻所在之卦'. This kind of internal contradiction can cause the agent to produce inconsistent or incorrect divination outputs, undermining reliability and making downstream reasoning depend on the wrong rule.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The usage note says '问事卦用通用规则，命卦用动爻规则，两者不可混用', but the earlier corrected section states the same 体用 rule applies to both 问事卦 and 命卦. This contradiction is dangerous because it can systematically mislead the agent into applying different logic depending on which section it follows, producing inconsistent or false analyses.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The reference materially exceeds the declared divination/interpretation scope by presenting ritual magic, exorcism, healing, spirit-summoning, and related practices as substantive content. In a user-facing skill, this scope expansion can mislead users about the nature of the tool and normalize potentially unsafe pseudomedical or occult instructions under an entertainment-oriented manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section provides step-by-step procedural guidance for performing talisman writing, incantation recitation, and ritual practice rather than merely describing historical concepts. Actionable ritual instructions increase the chance that users follow unsafe or delusion-reinforcing practices, including substituting them for medical, mental health, or practical decision support.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document discusses practicing talismans, incantations, rituals, healing, and using outcomes for decision-making without clear, proximal warnings about health, safety, and reliability limits. In this context, users may over-trust the material, defer medical care, or make consequential life decisions based on occult procedures framed as usable methods.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The reference file is materially outside the skill’s declared entertainment divination scope and instead provides extensive traditional Chinese medicine content. This broadens the agent’s apparent authority into health-related guidance, increasing the risk that users receive quasi-medical advice from a skill not designed, disclosed, or safeguarded for medical use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section explicitly discusses analyzing illness, predicting disease progression, treatment timing, and applying the text to clinical practice. In a skill marketed as entertainment fortune-telling, that creates a dangerous capability mismatch: the agent may generate medical-analysis or treatment-oriented guidance without appropriate safety controls, and users may rely on it for health decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This section presents medical-like remedies such as chant-based bleeding control, swelling reduction, hiccup stopping by startling, and toothache relief as actionable instructions without an immediate, prominent warning beside each remedy. Even though the document includes a general disclaimer elsewhere, users may rely on these steps instead of seeking timely medical care, especially for bleeding, pregnancy-related concerns, pain, or swelling where delay can worsen outcomes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file presents ritual claims such as using talismans or exorcistic practices to treat illness without a clear, proximate disclaimer that this is not medical advice and should not replace professional care. In the context of a divination/occult skill, users may be more likely to act on the guidance, creating a risk of delayed medical treatment or reliance on ineffective practices for health conditions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The disclaimer at the end says the material is only for cultural research and not guaranteed to work, but earlier sections provide concrete, step-by-step ritual and healing instructions, including '治病法' and ingesting symbol-treated water. This contradiction can mislead users into attempting pseudo-medical or occult practices despite the disclaimer, creating risk of delayed medical care and unsafe behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a Zhouyi-based divination skill with hexagrams, Meihua Yishu, Ziwei Doushu, Bazi, Qimen Dunjia, and multiple casting methods. This file instead contains reference material on Luban lore, building practices, carpentry rules, charms, and prohibitions, which is materially different from the stated divination scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a 周易/占卜 skill centered on hexagrams, numerology-style casting, 紫微斗数, 八字, 奇门遁甲择吉, 推背图, and related interpretation. This file instead provides reference material on 《鲁班书补》, including building talismans, incantations, apotropaic objects, and ritual application for construction tasks, which is materially different from the stated divination/interpretation scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file frames a ritual talisman as suitable for illness-related conditions such as insomnia, wound healing difficulty, postoperative complications, and extending life before clearly foregrounding that it is not medical treatment. Even though later sections include medical disclaimers, the early presentation and claimed benefits can encourage vulnerable users to overvalue the ritual or delay evidence-based care.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This reference file presents ritual practices for healing, prediction, and spirit invocation in an instructional format, including step-by-step methods and encouragement to 'practice' and 'verify,' while only offering a weak disclaimer at the end. In the context of a divination/occult skill, users may treat the material as actionable guidance for health or decision-making, which can mislead vulnerable users or displace evidence-based medical or safety-critical choices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file presents ritual practices for healing, exorcism, and prediction in an instructional format, including claims that exorcism can cure illness, without a prominent warning that such material is not medical, mental health, or safety guidance. In a divination/occult skill, users may be more likely to act on these instructions instead of seeking professional care, which can delay treatment or worsen vulnerable users’ conditions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.