Back to skill

Security audit

五运灵名

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese baby-naming skill made of Markdown guidance, with privacy and belief-based-content caveats but no hidden code, persistence, or system access.

Install only if you want a Chinese metaphysical naming workflow. Avoid sharing exact birth or family details unless needed, and treat the health, fate, and lifestyle claims as traditional belief-based suggestions rather than medical, psychological, legal, or financial advice. Ask for neutral naming criteria if you do not want gendered conventions applied.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (16)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill hard-codes Chinese-only behavior and mandates a fixed output style without giving users any language choice. This can cause the agent to ignore the user's preferred language, leading to unsafe misunderstandings, reduced accessibility, and incorrect user interpretation of important content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The display name and description are entirely in Chinese, with no indication that users can choose another language or that the skill is limited to a Chinese-speaking audience. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is written entirely in Chinese and structures the naming workflow, examples, and output templates exclusively around Chinese-language names, phonetics, and naming conventions. Under the policy rule for natural-language violations, this is a locale/language constraint that is not presented as an opt-in choice or clearly justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly requests highly sensitive personal data, including full name, sex, precise birth date and time, birthplace, and family information, but provides no guidance on data minimization, consent, retention, or secure handling. In an agent context, this can normalize over-collection of personal data and lead to privacy harm, profiling, or unsafe downstream use if the agent stores, logs, or reuses the information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document includes special restrictions targeting female names, such as instructing that women should avoid specific '孤寡运' numerology values. In a naming skill, this is more dangerous because it embeds unequal treatment directly into recommendations and can produce discriminatory advice framed as authoritative or mandatory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The methodology mandates gender-specific naming rules such as '男孩用字刚健,女孩用字柔美' without presenting them as optional preferences. This can cause the agent to impose stereotyped or discriminatory outputs on users, especially where gender identity, parental preference, or cultural expectations differ.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown content contains a natural-language requirement that users 'must' use Traditional Chinese and Kangxi Dictionary stroke counts. That forces a specific language/locale convention without opt-in or a clear statement that the skill is intentionally limited to that locale or naming system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file presents belief-based naming guidance as if it can affect health, personality, fertility, disease risk, and life outcomes, without any disclaimer that these claims are cultural or entertainment-oriented rather than evidence-based. In a baby-naming skill, this can unduly influence sensitive parental decisions and may cause users to avoid names or make choices based on unsupported medical and psychological assertions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill offers users a language/locale option or that the Chinese-only format is required for a region-specific purpose. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. This file presents all instructions and content exclusively in Chinese, with no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown skill content forces a specific language/locale throughout the document and does not offer an alternative language or note that Chinese is a deliberate user-selected option. Under the policy, language-specific content can be a natural-language policy issue when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The text gives prescriptive gender-based naming guidance such as associating certain phonetic qualities and style traits with boys versus girls without qualification or user choice. In a naming skill, this can reinforce stereotypes and lead the agent to produce exclusionary or biased recommendations, especially for users who do not want gender-conforming names.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document explicitly states naming meaning/style guidance in gendered terms, e.g. '男孩刚健,女孩柔美', which frames gender presentation as normative. If used directly by the skill, this may steer outputs toward stereotyped or unwanted name choices and reduce inclusivity for users with different cultural or personal preferences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This markdown file is written entirely in Chinese and presents all instructional content in a single language without any indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

SQP-3 applies to all file types and flags natural-language policy issues such as forcing a specific language without user opt-in. This file presents all instructional content only in Chinese and does not indicate that the language choice is optional or required for a justified region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This section gives concrete lifestyle, diet, environment, direction, and adornment recommendations framed as corrective actions, but it does not warn that the guidance is speculative, non-scientific, and not professional medical or financial advice. In the context of a baby-naming and fate-analysis skill, users may treat the recommendations as authoritative and make real-world decisions affecting health, spending, or living arrangements based on unsupported claims.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.