Security audit

八字算命AI大师

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese-language divination skill that runs local calculation scripts and does not show hidden persistence, exfiltration, or destructive behavior.

Install only if you are comfortable with a Chinese-only divination workflow that may ask for birth date/time, gender, city, a specific personal question, or home/office layout details. Treat all results as cultural entertainment, not medical, legal, financial, or safety advice, and avoid sharing unnecessary personal or third-party information.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a three-in-one divination skill, but the code chunk only covers one component: deterministic BaZi calculation. The script does match parts of the description about true solar time correction and reproducible chart generation. However, it lacks any code related to Mei Hua Yi Shu, feng shui assessment, or event-specific divination. It also does not perform the richer interpretive functions advertised ('看格局、性格、婚恋财官趋势与大运流年' and '断吉凶与时间点') beyond generating structured astrological components like pillars, ten gods, five-element tallies, and DaYun schedules. Therefore, the supplied code materially underimplements the declared purpose and does not accurately represent the full described behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description advertises a broad three-in-one metaphysics assistant centered on Bazi, Meihua, and feng shui, with deterministic, reviewable calculations including true solar time correction and ti-yong judgment. The code chunk only covers one subset: Meihua Yishu hexagram generation and lightweight interpretation. It does include ti-yong and five-element judgments, which partially match the Meihua portion, but it lacks any Bazi charting, personality/marriage/career/luck-cycle analysis, and any feng shui assessment. Additionally, the script provides a --random mode using Python's random module, which conflicts with the claim that charting/divination is done by deterministic scripts. Therefore the supplied code does not accurately represent the full declared purpose and contains a material capability mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Forcing Chinese responses even when the user asks in English can defeat user comprehension and informed consent, especially when the skill requests sensitive birth details or discusses health, legal, financial, or crisis-related matters. In this context the risk is elevated because misunderstanding can lead users to share personal information unintentionally or misinterpret safety disclaimers and high-stakes guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README says the skill triggers whenever users mention broad terms like 算命、八字、起卦、风水、运势, which can easily appear in unrelated conversations. This can cause unintended activation, leading the agent to steer normal discussions into divination workflows and potentially collect sensitive birth, location, or personal-life details without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README states the skill will use a fixed opening script and produce a fixed five-part interpretation, and the entire documented interaction is presented only in Chinese with no indication that users may choose another language. This creates a natural-language locale constraint without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad everyday terms such as 运势、风水、命理 that can cause the skill to activate in conversations where the user did not clearly request this skill. Unintended activation can route users into collecting sensitive birth data or receiving high-stakes pseudo-advice in contexts where they expected something else, increasing privacy and safety risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The usage conditions are broad enough to match loosely related requests, including generic trend, decision, or traditional-culture questions. In this skill context that is more dangerous because activation leads quickly into collection of personal data and guidance on health, legal, financial, and emotional topics, which can misroute vulnerable users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and all user-facing guidance are written entirely in Chinese, and the CLI interface also constrains key user input such as gender to Chinese values only. This effectively imposes a specific language/locale on users without any opt-in or alternative, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest declares many short, generic triggers such as "算命", "八字", "排盘", "风水", and English equivalents like "bazi" and "fortune telling", which are likely to overlap with ordinary user queries rather than clear skill-invocation intent. This can cause the skill to activate unexpectedly, intercept unrelated conversations, and steer users into a niche domain without explicit opt-in; in a divination skill, that raises additional risk of unsolicited sensitive inference or advice-seeking interactions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest presents the skill primarily in Chinese terms and trigger phrases, with no indication that users can choose their preferred language or locale behavior. Because the skill appears generally applicable rather than region-restricted, this creates a natural-language policy concern around implicit language forcing without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring, CLI description, status messages, and generated output are all written in Chinese, and the skill does not indicate that language is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module docstring presents usage with --minute 30 for '按时间起卦', implying minutes are part of the deterministic calculation. However, time_to_yue_ri_shi is called with only year/month/day/hour and main() never passes args.minute, so the minute argument has no effect on the result.
Content: No source excerpt is available for this finding.