Vedic Astrology

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:23 PM UTC
• Version: 1.2.0

Overview

This is a coherent Vedic astrology skill, but it should be reviewed because it silently reuses and stores identifying birth-profile data.

Review this before installing if you do not want an agent to save or silently reuse birth details. The main risk is local privacy and cross-skill profile sharing, not malware: the skill should ideally ask before reading fortune-hub memory or writing MEMORY.md, show the values it plans to use, and provide a clear way to skip, correct, or delete stored data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:69
• Finding: Unnecessary Cross-Skill Access and Persistent Storage of Personal Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-100`; corroborating cache instruction at `SKILL.md:218-220` **Vulnerability Type**: Cross-Skill data access and automatic plaintext persistence of personal profile data **Risk Level**: Medium ### Vulnerable Code ```markdown **Reading**: Before running, check in this order: 1. This directory's `MEMORY.md` — use first 2. `fortune-hub/MEMORY.md` in the same repo (if it exists) — fill in any missing base profile fields If data is available, use it directly without asking again. **Writing**: After collecting user info, write it to **this directory's** `MEMORY.md`: ```markdown # User Info ## Basic Profile - Date of birth: YYYY-MM-DD - Birth time: HH:MM (24-hour) - Birthplace: City name - Birth time zone: UTC+X ## Chart Cache - Sun sign (sidereal): Sign, approx. ° - Moon sign (sidereal): Sign, approx. ° - Moon Nakshatra: Name (Nakshatra #N) - Nakshatra ruling planet: Planet - Birth Dasha planet: Planet - Current Mahadasha: Planet (YYYY–YYYY) ``` | Field | Required | How to ask | |-------|---------|------------| | Date of birth | ✅ | "Please share your birth date (year, month, day)" | | Birth time | ✅ Needed for Ascendant and precise planetary positions | "What time were you born? (If unsure, a rough time of day is fine — it affects the Ascendant calculation)" | | Birthplace | ✅ Needed for time zone and geographic latitude | "What city or region were you born in?" | **Updating**: Update `MEMORY.md` when the user requests changes. ``` Additional persistence instruction: ```markdown ### Step 5: Save Results After the first complete reading, cache the chart estimates to `MEMORY.md`. Subsequent single-module queries can draw from the cache directly. ``` ### Technical Analysis The Skill instructs the agent to read personal profile information from both its own memory and the memory belonging to a sibling Skill. It then directs the agent to use that information without asking the user again and ...[truncated 2696 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove access to `fortune-hub/MEMORY.md` unless cross-Skill profile sharing is essential to the documented capability. 2. Require explicit, informed user consent before reading any sibling Skill's memory. Identify the source and enumerate the fields that will be imported. 3. Confirm that stored information belongs to the current user and remains accurate before using it in calculations. 4. Default to session-only processing. Do not create or update `MEMORY.md` unless the user explicitly opts into persistence. 5. Minimize stored data. Prefer caching non-identifying calculation results, and avoid retaining exact birth time and birthplace unless necessary. 6. Define a retention period and provide commands or documented procedures to view, correct, and delete stored data. 7. Prevent automatic propagation between memory files. Imported data should not be copied into another persistent store without separate consent. 8. Apply restrictive file permissions and ensure memory files are excluded from version control, logs, exported artifacts, and shared repositories. 9. Record provenance and freshness metadata for any retained fields so stale or cross-user data can be detected. 10. Replace “use it directly without asking again” with a confirmation step that displays the proposed values and allows correction before processing. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (11)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to persist highly identifying birth data and derived chart information without a clear upfront notice that the information will be stored for future reuse. This undermines informed consent and creates substantial privacy risk because exact birth date, time, and place are sensitive personal attributes that can persist beyond the immediate task.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Using the single trigger term 'Vedic' is overly broad and can activate the skill in unrelated contexts, causing unintended handling of user messages and potentially prompting unnecessary collection of birth data. Overbroad invocation increases the chance that sensitive workflows run without clear user intent.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest frames the skill as pure reasoning without external dependencies, which suggests a self-contained interpretive capability. However, the documented workflow explicitly reads from MEMORY.md and writes user birth data and chart cache back to disk, introducing stateful storage behavior beyond pure LLM reasoning.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The top-level documentation describes the skill as pure LLM reasoning, which implies no auxiliary data-loading or persistence behavior. Later sections instruct the agent to load reference documents and persist user data/results in MEMORY.md, contradicting that characterization rather than merely omitting detail.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs collection and storage of sensitive personal data, including date of birth, birth time, birthplace, and timezone, in persistent memory. That exceeds what is strictly necessary for a one-time reading and creates privacy risk if the data is later accessed, repurposed, or exposed to other skills or sessions.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The instruction to read stored birth details and reuse them 'without asking again' removes an important consent and context check for sensitive data. Reuse across sessions or tasks can surprise users, cause privacy boundary violations, and propagate stale or incorrect identity data into later interactions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. This directory's `MEMORY.md` — use first
2. `fortune-hub/MEMORY.md` in the same repo (if it exists) — fill in any missing base profile fields

If data is available, use it directly without asking again.

**Writing**: After collecting user info, write it to **this directory's** `MEMORY.md`:

• Confidence: 91% confidence
• Finding: The phrase 'use it directly without asking again' authorizes autonomous reuse of sensitive personal data without a fresh user decision. In this skill's context, that means the agent can act on intimate identifying information and derived profile fields without contemporaneous confirmation, increasing privacy and consent risk.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Caching a detailed personal profile and derived chart data creates a persistent dossier that goes beyond transient task execution. Even if intended for convenience, this enlarges the blast radius of any memory exposure and enables future inference about the user's identity, habits, or beliefs.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Telling the agent to cache full reading results for future queries preserves not just raw birth details but also derived personal interpretations. Persistent storage of these outputs can expose sensitive inferences and makes later misuse or unintended disclosure more damaging.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match

Content

ore Quality (1–2 sentences) |
|---|-----------|---------|------------------------------|
| 1 | Ashwini | Healing, speed, new beginnings | Bursting with the vitality of a swift horse, Ashwini natives are natural healers and pioneers — quick to act, though patience may need cultivating. |
| 2 | Bharani | Transformation, responsibility, creativity | Carrying souls between worlds, Bharani holds a fierce sense of responsibility and creative drive — capable of breaking through at the edges, with emotions that run deep and hot. |
| 3 | Krittika | Sharpness, purification, precision | Burning like a flame, Krittika is razor-sharp and pure — driven by keen discernment and critical thinking, pursuing excellence without compromise. |
| 4 | Rohini | Prosperity, beauty, nourishment | Considered one of the most auspicious of all Nakshatras, Rohini radiates material abundance and sensory beauty — emotionally warm, with an instinctive attunement to loveliness in all its forms. |
| 5 | Mrigash

• Confidence: 65% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The statement 'This Skill uses the Lahiri system by default' imposes a specific astrological system in natural language without indicating that users can choose alternatives, even though multiple systems are presented above. This can be a locale/method policy concern because it defaults users into one convention without explicit opt-in or selection.

Static analysis

No suspicious patterns detected.