Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese-language fortune, career, and health-style analysis skill with no evidence of hidden data access, persistence, network exfiltration, or privilege escalation.
Install only if you are comfortable entering birth date, time, and optional gender into a local astrology-style tool. Treat all health output as entertainment or general reflection, not diagnosis or medical advice, and use qualified professionals for health decisions.
The trigger list is broad and includes generic terms like “摘要”, “职业分析”, and “健康分析”, which can cause the skill to activate on ordinary conversation rather than clear, informed user intent. Because the skill processes birth data and produces health-related output, accidental activation increases privacy risk and may generate sensitive or misleading advice without explicit consent.
The skill solicits and processes sensitive personal data, including birth date/time and health-related information, but provides no warning, consent notice, retention statement, or limitation on medical interpretation. This is dangerous because users may disclose regulated or highly sensitive data without understanding the privacy implications, and the resulting health analysis may be mistaken for professional medical guidance.
This file’s docstrings, comments, and user-facing examples consistently assume Chinese as the only language of interaction. The policy requires flagging language or locale constraints when they are forced without user opt-in or clear justification.
This file’s natural-language content, including the top-level docstring and explanatory comments, is exclusively Chinese. Under the stated policy, forcing a specific language without opt-in can be a locale/language policy violation when no alternative or justification is provided.
This code hardcodes Chinese-language descriptions and command phrases, and the CLI help and outputs are also presented only in Chinese. That creates a language/locale policy issue because the skill does not offer the user any language selection or explicit opt-in to a Chinese-only experience.
The module description and all user-facing report text are written exclusively in Chinese, indicating the skill is designed to output results in a fixed language. Under the stated policy, a skill should not force a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.
The code generates health-risk assessments and lifestyle recommendations that reference organs, disease risks, and annual health warnings, but it does not present any disclaimer that the output is non-medical, non-diagnostic, and should not replace professional care. In a health-related skill, users may over-trust these statements and delay seeking qualified medical advice, especially because the output is framed as an analysis report with concrete warnings.
This file contains the skill description entirely in Chinese, which imposes a specific language/locale in natural-language content. The policy allows locale constraints only when users are given a choice or the restriction is clearly justified, neither of which is present here.
The entire skill description, triggers, inputs, and outputs are presented only in Chinese, with no indication that users may interact in another language or that the Chinese-only constraint is intentional and justified. This can constitute a language/locale policy issue when no user opt-in or documented locale limitation is provided.
This file contains user-facing natural-language content in docstrings and comments exclusively in Chinese, which effectively imposes a language choice on readers and maintainers without opt-in. Under the stated policy, forcing a specific language without user choice or clear region-specific justification is a natural-language policy concern.
The docstring says the function gets '大运' and describes simplified forward/reverse fortune-cycle handling, which implies some calculation of luck-cycle information. In reality, the implementation does no such computation and simply returns bazi['str'], contradicting the documented intent.
The file’s natural-language interface is entirely Chinese, including the module description and later user-facing output labels, with no indication that language is configurable or limited to a Chinese-only context. This can violate language/locale policy when users are not given an opt-in or alternative locale.
The formatted report returns Chinese phrases such as “当前”, “岁”, and “运” directly in the output, which enforces a specific locale in the skill’s user-visible responses. There is no visible mechanism for user selection of language or documentation justifying a region-specific restriction.
format_strength_detail formats output using bazi['day_master'], but analyze_strength_detailed only reads the local day_master variable and writes other derived fields back into bazi without storing day_master. This creates a documentation/intent mismatch inside the module: the formatting helper appears intended to consume the output of the analyzer, but the analyzer does not populate all fields the formatter claims to use.
This file hardcodes all user-facing report strings in Chinese, including relationship descriptions and the final formatted output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
The module docstring states its purpose and supported input behavior only in Chinese, including '用户输入自动识别', which implies expected user interaction in a specific language/locale. There is no indication that the skill offers a language choice or that it is explicitly scoped to a Chinese-only regional use case.
Natural-language strings throughout the file, including the module description and generated report text, are exclusively in Chinese, and the code provides no option for users to select another language. Under the stated policy, forcing a specific language without user opt-in is a locale-policy issue unless the constraint is explicitly documented and justified.
No suspicious patterns detected.
