Qimen Dunjia — 奇门遁甲

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.0

Overview

This is a local markdown-only Qimen Dunjia divination skill with disclosed optional preference memory and no code execution, network use, or credential access.

Safe to install if you are comfortable with a Chinese-language divination assistant. Treat outputs as reflection or entertainment, not professional advice, and do not save sensitive life, relationship, financial, medical, or legal details in MEMORY.md unless you intentionally want them reused.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to read and persist user preferences in MEMORY.md without any explicit consent flow, retention limits, or privacy notice near the storage behavior. This can cause unintended collection and reuse of sensitive preference data across sessions, especially in a fortune-telling context where users may disclose personal beliefs, plans, or life concerns.

VirusTotal

63/63 vendors flagged this skill as clean.