Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese divination skill with limited local preference memory and no executable code or external API behavior.
Install only if you want a Chinese-language Liuyao/Yijing divination assistant. Be aware it may remember explicit preferences such as divination method or response style in a local MEMORY.md file, and do not treat its finance, health, legal, or life-decision readings as professional advice.
The trigger list includes broad natural-language phrases such as “帮我起一卦”, which can plausibly appear in casual conversation without strong domain constraints. This can cause the skill to activate unexpectedly, increasing the chance that users are routed into fortune-telling behavior when they did not clearly intend it, especially in mixed-topic chats.
The skill explicitly reads from and writes to persistent MEMORY.md files containing user preferences, but the main description does not clearly warn users that persistence is occurring. This creates a privacy and consent risk because users may disclose sensitive preference or behavioral information without understanding it will be retained across sessions.
Line L003 states that divination must strictly follow the tables in this file, and the entire skill file is presented only in Chinese with no indication that users may choose another language or locale. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue unless the locale restriction is explicitly justified.
The skill description, examples, and operating instructions are written entirely in Chinese and present Chinese trigger phrases only, implying a fixed language expectation. There is no indication that users may choose another language or that the locale restriction is intentional and justified as a region-specific tool.
