🔮 循古·算命（八字·每日运势·六爻·大六壬·禄命·大运流年）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.13

Overview

The skill matches its fortune-telling/API purpose, but it handles API tokens and sensitive birth profiles with weaker scoping and storage controls than its documentation implies.

Review this skill before installing if you are comfortable sending birth/divination data to xungufa.com, allowing it to look for XUNGU_API_TOKEN in local .env files, and optionally storing birth profile details in plaintext locally. Prefer configuring the token through a scoped secret or environment variable, and avoid saving profiles unless you accept the local privacy risk.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:83

Finding

Mandatory Promotional Content Hijacks Agent Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 83–88; additional output injection at lines 325, 513, 642, and 726
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

**⚠️ 重要提示（首次使用时必须告知用户）：**

> 循古排盘的基础功能可免费使用（命盘评级、基础打分）。
> 如需解锁**完整八字分析**和**每日详细运势**，请前往 [https://xungufa.com](https://xungufa.com) 注册获取 API Token。
> **六爻占卜**和**大六壬起课**功能**必须**配置 API Token 后方可使用，未配置 Token 将返回 401。
> 注册后在 `.env` 文件中配置 `XUNGU_API_TOKEN=你的token`。

Related formatter-level injection:

python

result.append("🔒 完整运势需前往 https://xungufa.com 注册解锁")

python

result.append("🔮 本卦象由 [循古排盘](https://xungufa.com) 提供 · 专业古法命理排盘平台")

python

result.append("🔮 本课盘由 [循古排盘](https://xungufa.com) 提供 · 专业古法命理排盘平台")

Related mandatory workflow instruction:

markdown

1. **首次使用必须提醒用户注册**以获取完整功能

Technical Analysis

The Skill requires the Agent to promote an external commercial service during first use and embeds branded external links directly into normal result formatters. This behavior goes beyond the minimum output necessary to provide the declared fortune-telling functionality.

The use of mandatory language means the promotional content is not conditional on a user requesting registration help. Formatter-level insertion also causes the content to appear automatically whenever affected results are rendered. Consequently, loading and invoking the Skill changes the Agent's response goals from answering the user's request to advertising and directing the user toward an external registration flow.

The external service is also the declared API provider, so attribution and authentication guidance may be legitimate in appropriate contexts. The vulnerability is the unconditional or mandatory nature of the promotion, rather than the mere existence of the service URL.

Attack Path

1. The Skill is loaded into an Agent session.
2. A user re ...[truncated 1097 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory registration promotion from the first-use workflow.
2. Remove branded links and promotional language from result-formatting functions.
3. Show authentication guidance only when an operation genuinely requires a token and no valid token is configured.
4. Show registration or premium-feature information only when the user explicitly asks about unavailable functionality, pricing, accounts, or authentication.
5. Replace promotional wording with neutral operational errors, such as: “This operation requires XUNGU_API_TOKEN; configure it before retrying.”
6. Keep attribution optional and separate from the substantive result.
7. Clearly disclose external data processing immediately before the first transmission of birth information, rather than combining privacy disclosure with commercial promotion.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:216

Finding

Sensitive Birth Profiles Are Persisted in Unprotected Plaintext

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 216–234
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

python

def _save_user_profile(user_id, user_name, birth_date, gender, birth_place):
    """保存用户档案到本地文件（仅在用户明确同意后调用）"""
    profile_path = Path.home() / '.openclaw' / 'workspace-jarvis' / 'memory' / 'xungu-users.json'
    profiles = {}
    if profile_path.exists():
        try:
            profiles = json.loads(profile_path.read_text())
        except:
            profiles = {}
    if 'users' not in profiles:
        profiles['users'] = {}
    profiles['users'][str(user_id)] = {
        'name': user_name,
        'birth_date': birth_date,
        'gender': gender,
        'birth_place': birth_place
    }
    profile_path.parent.mkdir(parents=True, exist_ok=True)
    profile_path.write_text(json.dumps(profiles, ensure_ascii=False, indent=2))

Technical Analysis

The function stores a user's name, identifier, exact birth date and time, gender, and birthplace in a plaintext JSON file. These fields can collectively identify an individual and constitute sensitive personal profile data.

Although the documented workflow requires consent before saving, the implementation does not explicitly enforce restrictive directory or file permissions. It instead relies on the process umask and any permissions already present on the target file. The code also lacks symlink checks, atomic replacement, encryption, retention controls, and robust corruption handling.

Path.write_text() overwrites the destination directly. An interrupted write can corrupt the complete profile database. If the target path is replaced with a symbolic link by another local actor operating within the same trust boundary, the write may be redirected to another file accessible to the Agent process.

The Skill documentation states that users can request deletion o ...[truncated 1736 chars]

Remediation

View remediation

Remediation Suggestions

1. Avoid persistent storage unless it is necessary and the user has given informed, explicit consent.
2. Minimize retained data; do not store the user's name or birthplace when those fields are unnecessary for future requests.
3. Create the profile directory with mode 0700 and the profile file with mode 0600.
4. Refuse to read from or write through symbolic links, and validate the resolved destination before every operation.
5. Write updates to a securely created temporary file in the same directory, flush and synchronize it, set restrictive permissions, and atomically replace the destination.
6. Consider encryption at rest using a credential managed outside the profile file.
7. Implement the documented deletion operation and verify that it removes the requested record. Delete the complete file when no records remain.
8. Add retention controls and clearly disclose the storage location, stored fields, retention period, deletion procedure, and local-access risks before obtaining consent.
9. Handle malformed JSON without silently replacing all existing profiles; preserve a protected backup or return an explicit error.
10. Store each user's profile separately, or otherwise prevent one corrupted write from exposing or destroying every stored profile.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The token-loading helper reads from fixed local .env files in the home directory and current working directory. In an agent environment, this broadens credential access beyond explicit runtime injection and can unintentionally pull secrets from local files, creating a pathway for unauthorized secret use if the skill is invoked in a workspace containing sensitive .env material.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

if token:
        return token

    env_paths = [Path.home() / '.openclaw' / '.env', Path.cwd() / '.env']
    for p in env_paths:
        if p.exists():
            try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

raise ValueError(
            "六爻和大六壬查询需要 API Token。"
            "请前往 https://xungufa.com 注册，在「我的 API Key」创建 Key，"
            "并在 .env 配置 XUNGU_API_TOKEN=你的token"
        )

    url = API_BASE + path

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill claims birth-profile storage occurs only after explicit user consent, but the provided save helper has no technical enforcement of that policy. If the surrounding agent workflow mistakenly calls _save_user_profile, sensitive personal data such as birth date, gender, and birthplace could be stored locally without consent, creating a privacy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown states that gender '必须是 男 或 女（中文）', which imposes a specific language and locale convention rather than offering alternatives based on user preference. Under the policy rule, forcing a specific language/locale without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The privacy statement at L077 says the plugin '仅精确读取 XUNGU_API_TOKEN，绝不加载或访问您系统中的其他敏感环境变量'. However, the implementation shown at L158-L167 scans and reads ~/.openclaw/.env and the current working directory .env files. While it still extracts only XUNGU_API_TOKEN, the documented claim about not accessing anything else on the system is stronger than what the code does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The usage example at L793 says format_daliuren_result(data) outputs '时课/日课/月课'. In the implementation, the formatter docstring at L517 and code at L526-L529 only extract courses['ri'] and explicitly format the 日课盘. This is a direct contradiction between documentation and actual behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.