Security audit

谛观·解卦 | Hexagram Interpreter

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its hexagram-analysis purpose, but it should be reviewed because it tells the agent to persist personal feedback and preferences in local and global memory and to steer users toward detailed external feedback submissions.

Install only if you are comfortable with the skill storing feedback and preferences on disk and potentially in global agent memory. Avoid sharing private relationship, health, financial, legal, or third-party details in feedback, and treat GitHub issue links as external submissions that may be visible outside the agent environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:213
Finding: Persistent Modification of Global Agent Memory
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:570
Finding: Fixed External Feedback Template Injected into Agent Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:190
Finding: Unconsented Local Retention of Conversation-Derived Feedback
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unbounded Dependency Version Constraints
Content: View full analysis
=2.10.0 lunar-python>=1.0.0 ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. A future installation may therefore resolve to package versions that did not exist when the Skill was reviewed. The packages are imported directly by `scripts/calendar.py`: ```python import swisseph as swe from lunar_python import Solar, Lunar ``` Python package installation and import can execute third-party package code. Open-ended constraints weaken build reproducibility and make it difficult to establish that the installed artifacts match those reviewed during the audit. No evidence of typosquatting, dependency confusion, malicious package sources, or currently malicious dependency behavior was found. This finding concerns supply-chain hardening rather than a confirmed malicious package. ### Attack Path 1. An installer resolves the dependencies at a later date. 2. The package manager selects newer releases satisfying the open-ended constraints. 3. Those releases have not been reviewed with this Skill. 4. The Agent imports the selected packages when calendar functionality is invoked. 5. Any compromised or vulnerable package behavior executes with the permissions of the Agent process. ### Impact Assessment A compromised dependency could potentially obtain the same privileges as the Python runtime, including access to files, environment variables, and network capabilities available to that process. The current likelihood is limited because no malicious dependency was identified. The primary present impact is non-reproducible installation and increased exposure to future supply-chain changes. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The supplied code is clearly related to the declared divination domain, so this is not an unrelated or malicious capability mismatch. However, the description materially overstates and mischaracterizes what this chunk actually does. The implementation is narrowly focused on 六爻排盘: mapping hexagrams, computing palace/世应/纳甲/六亲/六兽/旬空/变卦 and旺衰 scores from datetime and hexagram inputs. Although it references meihua/qigua only for hexagram-name mapping initialization, there is no substantive 梅花易数 reasoning pipeline, and no 六壬 or 奇门 logic present. Also, the description emphasizes an interpretive '象推演系统' that expands possibilities and avoids吉凶 judgments, whereas the code provides calculation/arrangement primitives rather than user-facing interpretive output. Therefore the declared description does not accurately represent this code chunk's actual primary behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The description says the skill is mainly based on 梅花易数 + 六爻, with 六壬/奇门 merely auxiliary, and that it does not make auspicious/inauspicious judgments. This code chunk is instead wholly focused on 奇门遁甲排盘: constants, dun/ju calculation, jieqi handling, xun shou/xun kong, and construction of 天盘、地盘、九星、八门、八神. That is a materially different primary mechanism from the declared one. Additionally, the state output exposes 星吉凶/门吉凶/神吉凶 based on built-in attribute tables, which conflicts with the stated '不做吉凶判断' positioning, even if this chunk does not generate final prose judgments. There is no evidence here of 梅花易数、六爻、六壬 as the main logic or of a broader类象知识库-driven possibility expansion. Therefore this is a meaningful description-behavior mismatch rather than just an implementation detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs storing user feedback and preferences to local/global files without a clear up-front warning that conversation-derived data will be persisted. In this context, users may share sensitive relationship, health, finance, or career details, so undisclosed workspace writes materially increase privacy risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Broad trigger phrases such as '分析这事' and similar generic wording can cause accidental invocation during normal conversation. Unintended activation may route unrelated user content into the skill's specialized workflow or remote backend, creating privacy leakage, prompt hijacking surface, and unexpected behavior in host agents.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README presents the skill as an installable/open symbolic deduction assistant, but later reveals that the core logic is provided by a remote API. This is a supply-chain and transparency risk: users and host agents may assume local-only behavior while sensitive prompts, derived context, or usage metadata could be transmitted to an external service with different security and privacy controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The English trigger list includes ambiguous terms like 'divination' and 'symbolic deduction' without constraints, increasing the chance of false activation in unrelated contexts. In multi-skill environments, this can misroute user requests, expose conversation context to the skill, and amplify any downstream privacy or remote-processing risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The feedback section explicitly encourages users to submit detailed symbolic inputs, system outputs, expected interpretations, and contextual background, and states that this information will be used to train and improve the system. Without a prominent warning about privacy, sensitivity, and data-use implications, users may disclose personal, confidential, or third-party information they would not otherwise share.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Broad triggers like '分析这事' and generic divination-related phrases increase the chance of accidental activation in unrelated conversations. Unintended invocation matters here because the skill also requests personal context and may persist feedback or memory, amplifying privacy impact from mistaken activation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's stated purpose is hexagram interpretation, but it also instructs persistent storage of user feedback in local files for later optimization. This creates undeclared data retention that can capture sensitive personal details users may disclose during divination-style conversations, increasing privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly mandates persistent collection of user feedback and preferences in local and global files. Persistent storage of behavioral preferences and contextual notes creates avoidable sensitivity accumulation, especially for a skill likely to elicit personal concerns and reflective disclosures.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill writes cross-session 'style memory' to a global workspace file, including user preferences and recurring topics such as relationships, work, or technical decisions. Because these sessions may involve intimate or sensitive disclosures, global memory creates a durable profiling surface beyond what users would reasonably expect from a symbolic interpretation skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The feedback prompt asks users to submit full inputs, system outputs, desired interpretations, and contextual background to external issue links. That combination can expose sensitive personal narratives and interaction history to third-party or public systems, making oversharing and data leakage more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The external feedback flow encourages submission of detailed inputs, outputs, expected interpretations, and background context, but does not prominently warn that GitHub issues may be public and not suitable for sensitive disclosures. Given the skill's subject matter, users could easily share highly personal information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The English trigger set contains generic topical words and phrases including “divination”, “I Ching”, and “fortune reading”, which are not specific enough to uniquely indicate intent to launch this skill. In multilingual environments, these broad triggers increase accidental invocation risk and may hijack conversations merely discussing the topic rather than requesting execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The English trigger set contains generic topical words and phrases including “divination”, “I Ching”, and “fortune reading”, which are not specific enough to uniquely indicate intent to launch this skill. In multilingual environments, these broad triggers increase accidental invocation risk and may hijack conversations merely discussing the topic rather than requesting execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing labels are entirely in Chinese, with no indication that language is configurable or chosen by the user. Under the policy, a fixed language/locale is a natural-language policy issue unless the constraint is explicitly documented and justified or made opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file-level docstring and in-code documentation are entirely written in Chinese and the returned result keys are also Chinese-only, indicating the skill is designed around a fixed language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly says '不做吉凶判断', but the code hard-codes auspicious/inauspicious labels for stars, gates, and deities in XING_ATTR, MEN_ATTR, and SHEN_ATTR. These values are later surfaced in output via get_gong_info, so the implementation does more than neutral symbolic expansion.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This method returns '星吉凶', '门吉凶', and '神吉凶' for each palace, which are direct evaluative judgments rather than merely '展开丰富可能性'. That contradicts the manifest's stated boundary of not performing fortune-style good/bad determinations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module description, class/function docstrings, and returned user-facing strings are written exclusively in Chinese, which imposes a specific language on users and maintainers. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The changelog states the calendar module uses a default timezone of Asia/Shanghai. A fixed locale/timezone assumption can be a natural-language policy concern if applied to all users without explicit opt-in or a documented region-specific limitation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 62% confidence
Finding: The README says manual casting does not support Da Liu Ren or Qi Men because it lacks precise date/time/space data, yet it also presents manual workflows that could coexist with current-session time context. While this is documentation-level rather than code-level evidence, the stated hard prohibition conflicts with the broader description that AI can access current date for date-based casting.
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 70% confidence
Finding: Overly Broad Trigger: '解卦' is too short and may match unintended inputs
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 70% confidence
Finding: Overly Broad Trigger: '问卦' is too short and may match unintended inputs
Content: No source excerpt is available for this finding.