Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paid API connector for BaZi and Qi Men calculations, but users should understand it sends personal birth details and questions to an external service.
Before installing, review the provider's privacy policy and terms, configure only the intended API key, and avoid submitting birth details, sex, or sensitive life questions unless you are comfortable sending them to xiaoqizhisuan.cn. Also note that calls are pay-per-use, with the manifest requiring confirmation and a ¥2 per-session spend cap.
The skill sends sensitive personal data to a third-party API, including birth date/time, sex, and user questions, but does not present a prominent privacy warning at the point of use. Users may disclose highly sensitive profile and life-information without understanding that it is transmitted off-platform to an external provider, increasing privacy and compliance risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://www.xiaoqizhisuan.cn/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "x-api-key: ${XIAOQIZHISUAN_API_KEY}" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://www.xiaoqizhisuan.cn/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "x-api-key: ${XIAOQIZHISUAN_API_KEY}" \
Unlike the initialize and tools/list examples, this documented tool call transmits user-provided personal data such as birth date, birth hour, and sex to a third-party service. In context, the transmission is expected and disclosed at a high level, but it still creates a real privacy exposure because sensitive personal attributes are sent externally without a strong in-band warning or consent flow.
### 3. 调用指定工具 | Call Target Tool
```bash
curl -X POST https://www.xiaoqizhisuan.cn/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "x-api-key: ${XIAOQIZHISUAN_API_KEY}" \
The notes claim 'No feudal superstitious content is involved,' yet the rest of the document clearly describes astrology/divination-style capabilities such as BaZi queries, Qi Men chart generation, and complete chart interpretation. This is an active contradiction in the skill's own documentation about the nature of the service.
The manifest description references authentication with "xiaoqizhisuan.cn MCP service," which implies a specific regional service context. For manifest files, natural-language policy issues include locale-related constraints that are forced or undocumented; this file does not explain whether the skill is region-specific or offer any user choice.
No suspicious patterns detected.