Security audit

YunShi

Security checks for vulnerabilities and agentic risk

Overview

The skill is a fortune-telling helper, but it automatically persists private birth-chart data and can send recurring forecasts through messaging channels despite describing itself as offline.

Review this before installing if you plan to paste real birth-chart details. Use it only in a private workspace, avoid saving raw chart text unless you want reuse, confirm any scheduled delivery target carefully, and know how to remove user_chart_profile.json and disable host schedules if you no longer want persistence or pushes.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:73
Finding: Automatic Plaintext Persistence of Sensitive User Profile Data
Content: View full analysis
", "basic": { "gender": "", "clockTime": "", "trueSolarTime": "", "lunarTime": "", "baziJieqi": "", "baziNonJieqi": "", "mingZhu": "", "shenZhu": "" }, "chartRaw": "", "chartSummary": "" } ``` The profile template separately warns that real profile data should only be generated in a private local environment and should not be committed to the repository: ```text If a real profile is written, generate it in a private local environment and avoid committing it to the repository. ``` ### Technical Analysis The skill automatically writes user-supplied chart information to `{baseDir}/user_chart_profile.json` when a complete chart is detected. The stored data may include gender, exact birth-related timestamps, lunar and astrological bir ...[truncated 2741 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill markets itself as a local offline fortune-telling tool, but later instructs the agent to directly send generated content to external messaging channels during scheduled runs. That expands the capability surface from local content generation to outbound communication, creating a data exfiltration and unauthorized messaging risk if user profile data or generated content is sent without explicit per-use consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation grants the skill the ability to use multiple external messaging channels even though the stated purpose is a local offline oracle. Unnecessary outbound-channel authority violates least privilege and could be abused to spam third parties, leak stored profile content, or bypass user expectations about the skill's network behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language content of the skill is presented entirely in Chinese, including usage examples, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in is a locale/language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that a user's astrology chart/profile may be automatically persisted to a local JSON file, but it does not clearly warn users that personal profile data will be stored beyond the current session. Even if storage is local and offline, silent persistence of personal data can create privacy surprises, unauthorized reuse on shared systems, and retention risks if the workspace is later accessed by others.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill claims to be 'local offline' and forbids network retrieval, yet elsewhere mandates remote delivery to Telegram/Slack/Discord and similar services. This inconsistency is dangerous because it can mislead reviewers and users about the actual trust boundary, causing them to provide personal data under a false assumption that nothing leaves the local environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction "中文输出" forces a specific language for all responses. This is a natural-language locale policy issue because the skill does not offer the user a language choice or describe this as an explicitly region-limited tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly defines persistent local storage for a user's astrological profile, including raw chart text and related personal profile fields, but does not require clear notice, consent UX, retention limits, or protection for that stored data. Even if stored only locally, this creates privacy risk because sensitive personal data can be retained across sessions, accessed by other local users/processes, or unintentionally reused after the user no longer expects it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README advertises nightly scheduled fortune pushes but does not clearly warn that this may create recurring automated behavior when the host supports task scheduling. Users may not realize the action persists beyond the initial request, which can lead to unwanted notifications, confusion, or repeated execution without informed consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.