Security audit

qiyue-ziwei-drawer

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow astrology chart skill that calls a disclosed public QiyueAstro API with user-provided birth details, with no executable code or local privileges.

Install only if you are comfortable sending birth date, birth hour, gender, and any optional question text to qiyueastro.com to generate the chart. Avoid entering unnecessary personal details in the free-text question field.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly documents sending birth year, month, day, hour, gender, and an optional question to a third-party public API, but it does not warn users that this personal data leaves the local system. Birth date/time and gender are personal data and can be sensitive in some jurisdictions or contexts, so the omission can mislead users about privacy exposure and consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs users to provide full birth date, hour, and gender, then sends that data to a third-party API, but it does not present any explicit privacy notice, consent step, retention statement, or data-handling warning to the user. Birth data is sensitive personal information and can enable profiling or re-identification, so silent transmission to an external service creates a real privacy risk even if the service is legitimate.

Static analysis

No suspicious patterns detected.