Security audit

Meihua Yishu — 梅花易数占卜

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a low-risk divination skill with broad but purpose-aligned trigger phrases and no evidence of hidden execution, data theft, persistence, or destructive behavior.

Install only if you want an agent to answer Chinese divination-style prompts. Be aware that casual phrases like “算一卦” may route to this skill, so use clearer wording when you do not intend a divination response.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list includes broad natural-language phrases such as '帮我起一卦' and '算一卦' that can plausibly appear in ordinary conversation, making accidental routing or invocation more likely. In an agent ecosystem, over-broad triggers can cause the wrong skill to activate, leading to irrelevant behavior, unexpected memory reads/writes, or bypass of a more appropriate domain-specific flow.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The example invocations demonstrate activation through generic phrases like '帮我起一卦' and '算一卦，看看这件事情结果如何' without requiring an explicit skill name or stronger scope constraint. This trains routing systems and downstream maintainers toward permissive matching, increasing the chance of unintended activation when users are speaking loosely or metaphorically.

Static analysis

No suspicious patterns detected.