Security audit

Ziwei Verify

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it can treat simulated birth-time calibration as successful and keeps sensitive session data without clear expiry or ownership controls.

Install only if you are comfortable reviewing or fixing the simulated calibration path before relying on results. Treat birth time, gender, location, and chart outputs as sensitive personal data; avoid sending generated prompts to external LLMs without explicit user consent, and do not deploy the interactive session handler in a shared service until session IDs, ownership checks, expiration, and data deletion are implemented.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: calibrator.py:243
Finding: Simulated Chart Data Can Be Reported as a Successful Calibration
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: dialogue_handler.py:28
Finding: Caller-Controlled Session Identifiers Permit Cross-Session Data Access and Indefinite Sensitive-Data Retention
Content: View full analysis
str: state = DialogueState( session_id=session_id, original_packet=original_packet, birth_dt=birth_dt, candidates=candidates, selected_index=None, confirmed=False ) self.sessions[session_id] = state return self._render_welcome_message(state) ``` Possession of the identifier is sufficient to retrieve a stored candidate through selection: ```python def confirm_selection( self, session_id: str, selected_index: int ) -> Dict: if session_id not in self.sessions: return { "action": "reject", "message": "Session does not exist or has expired" } state = self.sessions[session_id] if 0 <= selected_index < len(state.candidates): state.selected_index = selected_index state.confirmed = True return { "action": "apply", "result": state.candidates[selected_index], "message": ( f"Selected option {selected_index}: " f"{format_shift_description(state.candidates[selected_index].shift_hours)}" ) } else: return { "action": "reject", "message": ( f"Invalid selection {selected_index}; select " f"0-{len(state.candidates)-1}" ) } ``` The advertised clean ...[truncated 2674 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:17
Finding: Third-Party Dependency Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (37)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation makes conflicting privacy claims: it says data is 'not stored' while also describing session tracking and configurable persistence/caching. For a module processing highly sensitive birth-time and profile data, this can mislead integrators and users into unsafe assumptions about retention and exposure, leading to unauthorized storage or inadequate consent/disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module handles sensitive personal data, including birth datetime and related profiling outputs, but the documentation does not give a clear user-facing warning about privacy implications, consent, retention, or access controls. In this skill context, such data is especially sensitive because it is directly tied to identity-like attributes and may be logged, cached, or used in interactive sessions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · DELIVERY.md (reported line 125)May include surrounding context.
方案B：HTTP API（若 ziwei 作为独立服务）

import requests resp = requests.post("http://localhost:8080/skills/ziwei/arrange", json=payload)

text
### 步骤2：安装依赖

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · DELIVERY.md (reported line 125)May include surrounding context.
方案B：HTTP API（若 ziwei 作为独立服务）

import requests resp = requests.post("http://localhost:8080/skills/ziwei/arrange", json=payload)

text
### 步骤2：安装依赖

Internal Network Request

Medium

Category: Server-Side Request Forgery
Confidence: 70% confidence
Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content: Scanner excerpt · DELIVERY.md (reported line 125)May include surrounding context.
方案B：HTTP API（若 ziwei 作为独立服务）

import requests resp = requests.post("http://localhost:8080/skills/ziwei/arrange", json=payload)

text
### 步骤2：安装依赖

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: 该技能说明全文使用中文，且没有声明这是面向特定中文用户或特定区域的专用技能，也没有提供语言切换或用户选择。按照语言/locale 政策，若技能实际上强制单一语言而无用户 opt-in，应视为自然语言策略违规。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation presents ziwei as an active dependency that provides real chart computation, and the examples describe actual recalculation during calibration. However, the known-limitations section explicitly says the current invoke_ziwei_skill() is only a mock implementation needing replacement, which contradicts the earlier operational description and could mislead users about what the skill actually does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language content of the skill, including its name, description, schemas, and operational notes, is presented in Chinese only. Under the policy, forcing a specific language without user opt-in or a clearly justified regional constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module presents itself as a confidence-maximizing birth-time calibration engine, but its placeholder scoring logic raises confidence based on distance from a fixed hour rather than evidence from real verification data. If this simulated path is used in production or trusted by downstream automation, it can systematically select arbitrary offsets and falsely label them as calibrated, causing integrity failures in decision-making based on the result.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing natural-language descriptions entirely in Chinese, beginning with the module title and behavior description. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation unless the constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring and all user-facing strings in this file are Chinese-only, which imposes a specific language on users. The policy allows fixed locale/language only when there is explicit opt-in or a clearly justified regional constraint, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language descriptions and console output entirely in Chinese, including the module docstring and test status messages. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring and user-facing parameter/return descriptions are entirely in Chinese, including invocation guidance and warnings, with no indication that another language is supported. This can violate language/locale policy when the skill is used in broader environments because it imposes a specific language without offering user choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This Python file hard-codes all visible output text in Chinese, including headers, prompts, and conclusions. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale-policy concern unless the skill is explicitly documented as region-specific, which is not evident in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module description and all user-facing templates are written exclusively in Chinese, and the code explicitly describes returning Chinese confidence/status text for end users. There is no indication that language choice is configurable or that the skill is intentionally limited to a Chinese-only regional context, which creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This is a natural-language policy issue because the file presents its purpose and interaction text in a single language only. There is no indication that the skill is region-specific or that users can opt into Chinese, which can violate language/locale choice requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The main user-visible console output is hardcoded in Chinese, which imposes a specific language on users. The file does not provide any locale selection, fallback language, or justification for restricting output to Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This plain-text prompt file contains all user-facing instructions and confirmations in Chinese only, and nowhere indicates that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. That creates a natural-language policy concern because it forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This plain-text template file is entirely hard-coded in Chinese across success, failure, interactive, report, card-message, and TTS outputs. Under the natural-language policy rule, enforcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code embeds all human-readable docstrings, schema descriptions, warnings, and error messages in Chinese, such as the module header, schema field descriptions, and validation errors. The file does not indicate that the skill is China-specific or provide any user opt-in or localization option, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file contains natural-language descriptions, headings, and field explanations exclusively in Chinese, which can impose a language/locale constraint on users or maintainers without opt-in. The policy allows fixed locale only when user choice is offered or the regional restriction is clearly justified, neither of which is present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: parse_birth_datetime advertises a timezone parameter but ignores it, and silently appends +08:00 whenever the input lacks an offset. In a date/time-sensitive skill, this can cause systematic misinterpretation of user birth times, leading to incorrect downstream calculations and potentially incorrect authorization, audit, or business logic decisions if reused elsewhere. The skill context increases risk because astrology/calendar calculations are highly sensitive to exact time and timezone handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example explicitly generates a prompt from a user packet and sends it to an external LLM service (openai.ChatCompletion.create) without any warning, consent flow, data minimization, or redaction guidance. Because the packet appears to include sensitive personal data such as birth date, gender, and location, this documentation normalizes transmitting potentially sensitive user data to a third party and can lead integrators to deploy privacy-unsafe behavior by default.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · 使用示例.md (reported line 429)May include surrounding context.
请求示例：

bash
curl -X POST http://localhost:5000/api/ziwei/analyze \ -H "Content-Type: application/json" \ -d '{ "gender": "M",

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 60% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · 配置说明.md (reported line 338)May include surrounding context.
python
# Python 代码 from ziwei_verify.config import set_config set_config(debug_mode=True)

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: prompt_generator_demo.py:17

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_prompt_generator.py:20

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T08 · Insecure Dependencies

SkillSpector

Intent-Code Divergence

Missing User Warnings

External Transmission

方案B：HTTP API（若 ziwei 作为独立服务）

External Transmission

方案B：HTTP API（若 ziwei 作为独立服务）

Internal Network Request

方案B：HTTP API（若 ziwei 作为独立服务）

Natural-Language Policy Violations

Intent-Code Divergence

Natural-Language Policy Violations

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Intent-Code Divergence

Missing User Warnings

External Transmission

Unsafe Defaults

Static analysis

Dynamic code execution detected.

Dynamic code execution detected.