Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only Chinese Qimen Dunjia divination skill with disclosed local preference storage and no executable code or network behavior.
Install only if you want Chinese-language Qimen Dunjia charting. Be aware that preference or session records may be saved locally in MEMORY.md if you ask for them or express defaults, so avoid saving sensitive personal details unless you intend to keep them.
The trigger list includes broad terms such as “奇门”, “遁甲”, and “择时”, which can plausibly appear in ordinary conversation or adjacent topics. This can cause unintended activation of the skill and lead to irrelevant fortune-telling output being injected into unrelated user interactions, creating routing and safety issues even without malicious intent.
The skill directs the agent to read and write user preferences to MEMORY.md, but the top-level description does not clearly warn users that preference data may be persisted. Because preference fields may reveal spiritual practices, decision habits, or recurring personal concerns, silent storage creates a privacy and consent problem.
The intent examples include generic phrases like “现在”, “今天”, “什么时候”, and “哪个方向”, which overlap heavily with normal speech. In a routing system, these ambiguous triggers increase the chance that the skill is selected when the user is asking a non-divination question, causing confusion, misrouting, or inappropriate advice in the wrong context.
The skill offers to save divination session records, including time, chart details, and summary interpretations, without an explicit warning that this may capture sensitive personal matters. Since users may ask about health, relationships, finances, or major life decisions, retaining session records can expose intimate data beyond what users reasonably expect.
This markdown file presents all guidance, examples, and required phrasing exclusively in Chinese, which effectively enforces a specific language for skill use. Under the policy rule, a forced language or locale without user opt-in or documented justification is a natural-language policy violation.
The instructions specify a default “中文术数顾问型” style and prescribe Chinese phrasing conventions, but do not indicate that users may choose another language. This is a natural-language policy concern because it imposes a locale/language preference without explicit user opt-in.
This markdown file presents all instructions and content exclusively in Chinese, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
