Ming

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:21 AM UTC
• Version: 1.1.0

Overview

This is a disclosed Chinese metaphysics entertainment skill using local calculators, with no observed network access, credential use, persistence, or destructive behavior.

Install only if you want a Chinese-language cultural/entertainment reference. Do not rely on it for medical, legal, financial, relationship, career, or other major decisions, and share birth dates or names only if you are comfortable with that local analysis. Expect simplified algorithms and possible accuracy limits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code substantially matches part of the declared purpose: it performs simplified BaZi charting and Five Elements analysis, and also returns zodiac information. However, the declared description presents a broader tool including zodiac matching and Chinese name analysis, and the usage guidance also mentions lucky directions and auspicious dates. None of those capabilities appear in this code chunk. There is no evidence of unrelated or risky undeclared behavior such as network access, file access, or external resource use. The mismatch is therefore a description-to-behavior scope mismatch: the description overstates capabilities that this supplied code does not implement.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises no explicit tool restrictions while the file includes verification commands invoking Python and references to script files, indicating shell and file-read capabilities may be available or expected. In an agent environment, undeclared capability use weakens least-privilege boundaries and can let the skill access local files or execute commands beyond its stated metaphysics purpose.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation scope is broad enough to capture sensitive requests about destiny, marriage, investment, health, and other major life decisions, increasing the chance the agent will provide culturally framed but unreliable advice in high-stakes contexts. Even though the file includes disclaimers later, broad triggers can still route inappropriate conversations into this skill before safer domain-specific handling occurs.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The title and description present the skill entirely in Chinese and describe it as '你的中国传统命理参考工具' without stating that users may choose another language. This creates a language-policy concern because the skill appears to default to a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module title and description are entirely in Chinese and describe a Chinese-name analysis workflow, while the CLI usage and error messages are also Chinese-only. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module and function documentation state that the tool analyzes names using 五格剖象法, which requires correctly computing the five grids. However, the code computes 外格 as `tiange + renge + dige - renge + 1`, effectively `tiange + dige + 1`, while the adjacent comment says '总格 - 人格 + 1' and the separately computed `zongge` is not used. This is an active contradiction between the documented/intended formula and the implemented behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_json(args):
    result = subprocess.run(
        [sys.executable, *args],
        cwd=ROOT,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest sets the skill language to "zh", which indicates a fixed language/locale choice. Under the stated policy, a forced language setting is a violation unless the skill offers user choice or clearly documents and justifies the locale constraint; this file does not do so.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This code file contains user-facing natural-language descriptions and later CLI usage/error messages exclusively in Chinese, indicating a fixed language choice. The policy for this category flags language or locale constraints when they are forced without user opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The usage example and error output shown to end users are fixed to Chinese, which can violate language/locale policy when no choice is offered. There is no visible configuration, flag, or documentation allowing users to select another language.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This code file contains user-facing descriptions, usage text, keys, and error messages exclusively in Chinese, which effectively forces a specific language/locale. The file does not offer an opt-in language choice or document that the skill is intentionally limited to a Chinese-language or region-specific context.

Static analysis

No suspicious patterns detected.