Security audit
Security checks for vulnerabilities and agentic risk
HexaLotto is a disclosed entertainment lottery-divination skill that uses public lottery results and a local Python calculator, with no evidence of credential access, persistence, exfiltration, or destructive behavior.
Install only if you want a Chinese-language entertainment tool for lottery-themed divination. Treat all generated numbers as random entertainment, not betting advice, and be aware that generic phrases like '算一卦' or '排盘' may activate this skill unless the agent asks for confirmation.
This markdown file contains user-facing instructions only in Chinese, including the title, steps, and comments. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale limitation is explicitly justified.
The invocation examples use very broad natural-language phrases like “帮我算一卦” and “起一卦”, which can plausibly appear in ordinary conversation and trigger the skill unintentionally. Because this skill initiates web_search/web_fetch behavior and produces gambling-related predictions, accidental activation can lead to unexpected tool use, confusing outputs, and inappropriate engagement in a sensitive domain.
The trigger list includes broad phrases such as ‘算一卦’, ‘起一卦’, and ‘排盘’, which are not unique to lottery prediction and could activate this skill during unrelated divination or discussion contexts. Because the skill then directs the agent to perform web searches and process gambling-related content, accidental invocation can cause unintended external actions and misroute user requests.
This section gives concrete lottery-number recommendation mappings and report formats that facilitate gambling-oriented outputs, while the referenced file itself contains no warning, risk notice, or harm-minimization guidance. In the context of a skill explicitly designed to predict lottery outcomes, the omission increases the chance of encouraging gambling behavior or misleading users into treating divination-style output as actionable betting advice.
The module title, description, CLI help, and generated report text are written entirely in Chinese, and the file does not indicate any user-selectable language or that the tool is intentionally limited to a Chinese-speaking/regional context. Under the policy rule for language or locale constraints, this is a natural-language policy issue because the skill effectively imposes a specific language without opt-in.
The README is entirely Chinese-language and does not indicate that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale limitation is explicitly justified.
All user-facing instructions, trigger phrases, prompts, and output examples are specified only in Chinese, with no indication that other languages are supported or that the user can choose a language. This creates a language/locale constraint that is not presented as optional or justified as a region-specific requirement.
No suspicious patterns detected.
