Security audit

Yijing Divination

Security checks across malware telemetry and agentic risk

Overview

This divination skill is not clearly malicious, but it needs Review because it creates and handles third-party accounts/API keys and persists sensitive user data in the browser.

Review this carefully before installing. Treat it as a third-party account-based service, not just a local divination UI. Avoid entering sensitive personal, financial, medical, or relationship details unless you are comfortable sending them to the external service and having questions/history stored in the browser. Protect or rotate any API key it creates.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The API reference for a Yijing divination skill exposes unrelated account lifecycle functionality, including automatic registration and profile management. In an agent/tooling context, this expands the skill’s effective authority beyond divination and can lead agents to create accounts, retrieve credentials, or modify user data without clear user intent, increasing the attack surface and risk of misuse.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The UI includes account/profile and token-purchase functionality unrelated to a divination tool's stated purpose, expanding the trust boundary and creating unnecessary exposure to credential and billing workflows. While not inherently exploitable by itself, this scope creep is risky because users may provide sensitive data to a skill that did not justify needing it.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This section presents account creation, password handling, and API key display/copy features even though the skill is described only as a divination interface. Collecting and exposing credentials in a low-trust client-side page increases phishing, credential leakage, and user confusion risks, especially when a generated password is shown only once in the UI.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code loads an API key from localStorage and later also ingests it from the URL query string, which are both unsafe places for secrets in a browser app. Secrets in localStorage are accessible to any script running in the origin, and query parameters can leak via browser history, logs, screenshots, and referrer headers.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill explicitly states that first use will automatically create an account and return a username, password, and API key, without any user warning or consent step. This is dangerous because it can create third-party accounts and issue credentials silently, exposing users to unexpected data sharing, credential leakage, and unauthorized external service enrollment.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documents profile and divination API use, including AI interpretation requests that may contain user questions, but provides no user-facing privacy notice about what personal or sensitive data may be transmitted to the external service. In this context, users may submit intimate, emotional, or identifying information during divination, making undisclosed third-party processing more sensitive than a typical entertainment integration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documented auto-registration endpoint returns a username, password, and API key and requires no authentication, which is highly sensitive behavior for an agent-consumable skill. In this context, an agent could silently create accounts and handle raw credentials, leading to unauthorized account provisioning, credential exposure in logs, and downstream abuse of the issued API keys.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The profile update API documents transmission of sensitive fields such as email and password changes without any handling guidance, increasing the likelihood that agents or integrators will process credentials insecurely. Within this skill context, the danger is elevated because these account-management operations are adjacent to a non-essential divination tool, making accidental or unauthorized profile mutation more plausible.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Persisting the API key to localStorage without clear disclosure exposes sensitive credentials to theft through XSS, compromised third-party scripts, shared browser profiles, or local device access. Users are not informed that the key will remain stored after the session, increasing the chance of inadvertent exposure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill stores user questions and divination history in localStorage without disclosure. Because questions may contain intimate personal, financial, medical, or relationship details, silent retention creates a privacy risk on shared devices and exposes the data to any script executing on the same origin.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api.md:10

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tools/yijing.html:692