Security audit

🔮 赛博易经大师 | Cyber I Ching Master

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent I Ching and BaZi divination skill with expected birth-time input, and I found no evidence of hidden data access, network transfer, persistence, or destructive behavior.

Before installing, understand that BaZi readings require birth date and hour. Share only the minimum needed, avoid adding names, addresses, account details, or documents, and do not rely on divination output for medical, legal, financial, or other high-stakes decisions.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly asks users for full birth date and hour, which is sensitive personal data that can enable profiling, re-identification, or unsafe downstream handling if logged or stored. Even though SKILL.md is documentation rather than executable code, the documented interface encourages collection of personal data without any notice about minimization, retention, consent, or safe handling.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The skill persona, sample openings/closings, and interaction guidance strongly prescribe Chinese-only interaction without indicating that the user can choose another language. This can exclude users, cause misunderstanding of safety-critical disclaimers such as referrals for legal or medical issues, and reduce informed consent because users are pushed into a language mode they may not fully understand.

Static analysis

No suspicious patterns detected.