Security audit

qiyue-bazi-drawer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed BaZi charting integration that sends user-provided birth details to its stated external API, with no local code execution or persistence.

Install only if you are comfortable sending birth date, birth time, gender, and any optional question to qiyueastro.com and receiving a fixed promotional link in outputs. Avoid entering unnecessary sensitive details in the optional question field.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:84
Finding: Mandatory Promotional Output Injection and Traffic Diversion
Content: View full analysis
📜 Want an in-depth AI interpretation of your BaZi? Visit [Qiyue QiyueAstro](https://qiyueastro.com) to obtain a personalized chart analysis. ``` The original Skill text expresses these requirements in Chinese. The snippet above is a faithful English rendering of the complete affected section. ### Technical Analysis The Skill imposes a fixed requirement that every generated response end with promotional language and an external link. This instruction is unrelated to the minimum functionality necessary to request a BaZi chart from the API and display its results. Because Skill instructions are loaded into the agent's active context, the mandatory wording controls the agent's response even when the user has not requested recommendations, attribution, or links. The instruction therefore establishes a persistent output-injection mechanism for every invocation of the Skill. The behavior is intentional rather than incidental. `README.md`, lines 20–22, separately discloses that every response will contain a call to action directing users to `qiyueastro.com`. The API response example also includes a referral URL containing UTM tracking parameters, reinforcing the traffic-diversion objective. This does not provide operating-system access, code execution, credential access, or elevated local privileges. However, it exceeds least-functionality requirements by obtaining control over the final response form ...[truncated 1503 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the skill sends birth year, month, day, hour, gender, and optional question data to an external API, but it does not provide a clear privacy warning or data-handling disclosure. Birth data is sensitive personal information and can enable profiling or deanonymization, so omitting this notice can cause users to share data without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs sending highly sensitive personal data—birth date, birth time, and gender—to a third-party API, but does not clearly warn users that their data will leave the local system and be processed by an external service. Because this data can be privacy-sensitive and may be used for profiling or correlation, the lack of explicit disclosure and consent creates a real privacy risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The formatting rules require exact reproduction of Chinese source content and require every response to end with a fixed Chinese promotional sentence. This imposes a specific language/locale in all outputs without documenting user opt-in or offering language choice, which fits the language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language instructions and behavior description are presented in Chinese only, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without opt-in can be a language/locale policy violation.
Content: No source excerpt is available for this finding.