HexaLotto 六爻奇门测彩

Security checks across malware telemetry and agentic risk

Overview

The skill is a Chinese lottery-themed divination assistant with a small local script and no evidence of hidden access, persistence, credential use, or destructive behavior.

Install this only if you want a Chinese-language entertainment/divination skill for lottery number suggestions. Treat outputs as non-predictive entertainment, not financial advice or a reliable way to gamble, and be aware that generic Chinese divination phrases may trigger it unless your agent lets you control skill invocation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README uses very broad natural-language invocation phrases like "帮我算一卦下期双色球" and similar examples without defining clear trigger boundaries, exclusions, or required context. In an agent ecosystem, this can cause over-broad activation on unrelated conversations about lotteries, divination, or number analysis, increasing the chance the skill runs unexpectedly and performs web access or produces gambling-related outputs when the user did not explicitly intend to invoke it.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list includes broad, conversational phrases such as '算一卦', '起一卦', and '排盘', which can match ordinary user requests that are not actually about lottery-number prediction. This can cause accidental invocation of a gambling-related skill, leading to unexpected behavior, user confusion, and inappropriate exposure to betting-themed content.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The skill description and required output flow are entirely in Chinese and do not provide a language-selection or consent mechanism. In a multilingual environment, this can cause users to receive content they do not understand, including gambling-related guidance, increasing the chance of misunderstanding, unintended use, or failure to recognize disclaimers.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal