Security audit
Security checks for vulnerabilities and agentic risk
This skill openly runs a local lottery-divination script to generate entertainment lottery numbers, with no evidence of hidden access, persistence, network use, or data exfiltration.
Install only if you want a Chinese-language entertainment lottery-number generator. Treat the output as random entertainment, not financial advice, and be aware that the skill may activate on broad Chinese number-picking phrases.
The trigger definition is overly broad and explicitly includes casual phrases like '帮我算个号', making accidental or contextually unrelated activation likely. This can cause the agent to invoke the skill without clear user intent, overriding normal conversational flow and increasing the risk of inappropriate responses in unrelated contexts.
Mandating Chinese-only output without considering the user's language can cause unsafe or unusable interactions, especially if the user cannot understand disclaimers, gambling-risk warnings, or clarifications. In this skill, the disclaimer is a required safety control, so forcing a single language weakens the effectiveness of that protection for non-Chinese-speaking users.
This Python file includes its primary description, usage guidance, and user-facing output text in Chinese only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation, and there is no indication that users may choose another language or that the skill is intentionally region-restricted.
The comments repeatedly assert different, incompatible line encodings for the same trigrams, including remarks like 'No!', 'wait', and contradictory mappings for 巽/兑/震, before settling on a final table. This is more than incomplete documentation: the inline documentation actively disagrees with itself and with intermediate code states, making developer intent unclear for a divination engine whose output depends on exact trigram definitions.
