大乐透一站看

• Outcome: Review
• Latest audit: Sep 7, 2026 · 4:29 AM UTC
• Version: 2.1.48

Overview

The skill is a lottery report tool, but it also includes Windows SYSTEM scheduling, watchdog/restore flows, cross-profile file writes, and WorkBuddy database inspection that are too broad for that purpose.

Install only after reviewing the Windows automation pieces. Prefer running it manually as the current user, avoid creating the SYSTEM scheduled task, do not run restore with `--force` on untrusted backups, and disable or constrain desktop export, ledger recording, location lookup, and peer synchronization unless you explicitly want those local side effects.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

• Location: scripts/lib/dlt_restore.py:61
• Finding: SYSTEM-Level Scheduled Task Persistence Exceeds the Skill's Functional Requirements## Vulnerability Details **File Location**: `scripts/lib/dlt_restore.py:61-76`; `references/operations.md:106-111`; `SKILL.md:102-112` **Vulnerability Type**: Privileged scheduled-task persistence **Risk Level**: Critical ### Vulnerable Code ```python def restore_task(dest, force): xml = os.path.join(dest, f"{TASK_NAME}.xml") if not os.path.exists(xml): return False, f"Backup does not contain {TASK_NAME}.xml" if not force: return True, "dry-run" r = subprocess.run( ["schtasks", "/create", "/tn", TASK_NAME, "/xml", xml, "/f"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=30, ) ``` The documented deployment command further configures the task to run as the Windows Local System account with the highest run level: ```text schtasks /create /tn DLT_V8_Smart /tr "absolute-path\dlt_run_v8.bat" /sc weekly /d MON,WED,SAT /st 20:10 /ru SYSTEM /rl highest ``` ### Technical Analysis The Skill's declared core functionality is downloading public lottery information, analyzing that information, and generating a local report. These operations can be performed on demand under the invoking user's account and do not require a persistent SYSTEM-level execution mechanism. The project nevertheless treats a Windows scheduled task named `DLT_V8_Smart` as its preferred execution mechanism. The documented task: - Survives the current Skill invocation and user session. - Runs when no interactive user is logged in. - Executes as `SYSTEM`. - Uses the highest Windows task run level. - Runs a command from a mutable filesystem path on a recurring schedule. The restore utility can recreate this task through `schtasks /create`. Although actual creation requires the explicit `--force` option and administrative authorization, the resulting privilege and persistence are substantially broader than the minimum necessary for lottery-report generation. ...[truncated 1376 chars]
• Remediation: ## Remediation Suggestions 1. Remove SYSTEM-level scheduling from the distributed Skill and keep report generation as an on-demand, unprivileged operation. 2. If scheduling is optional, require a separate, explicit installation flow that is never invoked by normal report generation or health checks. 3. Register optional tasks under the current user rather than SYSTEM and avoid `/rl highest`. 4. Display the exact executable, arguments, working directory, principal, and triggers before registration. 5. Place scheduled code in a directory that unprivileged users cannot modify. 6. Pin the Python interpreter and verify script hashes before every scheduled execution. 7. Provide an uninstall command that deletes the task and clearly document whether it is currently installed. 8. Do not treat absence of a SYSTEM task as a health-check failure for the lottery-analysis functionality.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/dlt_restore.py:45
• Finding: Backup-Supplied Task XML Is Imported Without Integrity or Action Validation## Vulnerability Details **File Location**: `scripts/lib/dlt_restore.py:45-76` **Vulnerability Type**: Unvalidated privileged configuration restoration **Risk Level**: High ### Vulnerable Code ```python def _resolve(ts): if ts and os.path.isdir(os.path.join(BACKUP_ROOT, ts)): return ts if ts and os.path.isdir(ts): return ts return _latest_backup() ``` ```python def restore_task(dest, force): xml = os.path.join(dest, f"{TASK_NAME}.xml") if not os.path.exists(xml): return False, f"Backup does not contain {TASK_NAME}.xml" r = subprocess.run( ["schtasks", "/create", "/tn", TASK_NAME, "/xml", xml, "/f"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=30, ) ``` ### Technical Analysis The restore command accepts either a backup beneath the expected backup directory or a directly supplied directory. It locates `DLT_V8_Smart.xml` and passes that XML directly to Windows Task Scheduler. Before import, the implementation does not: - Authenticate the backup or task XML. - Compare it against a trusted manifest hash. - Parse and validate the task action. - Restrict the executable or script path. - Validate task arguments or working directory. - Restrict the principal, run level, or trigger definition. - Reject links or unexpected filesystem redirections. - Require that the restored action resolves to a trusted, administrator-owned file. Task Scheduler XML can define executable actions, arguments, triggers, principals, and execution behavior. Therefore, a modified backup can turn the recovery operation into privileged arbitrary command registration. The use of an argument list rather than `shell=True` prevents ordinary shell metacharacter injection, but it does not mitigate malicious content inside the imported XML. ### Attack Path 1. An attacker gains write access to a backup directory, supplies a ...[truncated 935 chars]
• Remediation: ## Remediation Suggestions 1. Cryptographically authenticate backup manifests and verify the task XML hash before import. 2. Parse the XML before invoking `schtasks`. 3. Enforce an allowlist covering: - Task name. - Executable path. - Script path. - Arguments. - Working directory. - Trigger type and schedule. - Principal and run level. 4. Resolve all paths and require them to remain within an administrator-owned installation directory. 5. Reject symbolic links, junctions, reparse points, and world-writable task targets. 6. Default restored tasks to the current unprivileged account. 7. Show a normalized task-definition diff and require separate confirmation before privileged import. 8. Prefer reconstructing a minimal task from trusted constants instead of importing arbitrary backup XML.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lib/dlt_healthcheck_all.py:123
• Finding: Default Health Check Scans User Profiles and Reads WorkBuddy Automation Databases## Vulnerability Details **File Location**: `scripts/lib/dlt_healthcheck_all.py:123-166`, `724-744`, and `990-1010`; invoked by `scripts/lib/dlt_smart.py:680-696` **Vulnerability Type**: Cross-account Agent configuration access **Risk Level**: High ### Vulnerable Code ```python def _iter_real_user_profiles(): root = os.path.expandvars(r"%SystemDrive%\Users") if os.path.isdir(root): skip = ( "public", "default", "default user", "defaultuser0", "all users", "systemprofile", "network service", "local service", ) for name in os.listdir(root): if name.lower() in skip: continue directory = os.path.join(root, name) if os.path.isdir(directory): yield directory ``` ```python def _candidate_workbuddy_dbs(): cands = [ os.path.expanduser("~/.workbuddy/workbuddy.db"), os.path.expandvars(r"%USERPROFILE%\.workbuddy\workbuddy.db"), ] for profile in _iter_real_user_profiles(): cands.append(os.path.join(profile, ".workbuddy", "workbuddy.db")) return cands ``` ```python db = None for candidate in _candidate_workbuddy_dbs(): if candidate and os.path.exists(candidate): db = candidate break if db: con = sqlite3.connect(db) con.row_factory = sqlite3.Row for row in con.execute("SELECT name FROM automations").fetchall(): name = row["name"] or "" ``` ```python cur.execute( "SELECT id, status FROM automations " "WHERE (id='v8' OR id='automation-1785599490412') " "AND (deleted_at IS NULL OR deleted_at=0)" ) ``` The normal execution path invokes this health check: ```python r = subprocess.run( [PYTHON, "dlt_healthcheck_all.py"], cwd=WORK_DIR, capture_output=True, text=True, timeout=1800, encoding="utf-8", errors="re ...[truncated 2098 chars]
• Remediation: ## Remediation Suggestions 1. Remove enumeration of the Windows users directory. 2. Restrict database access to the invoking user's profile. 3. Require an explicit path or opt-in flag before inspecting WorkBuddy state. 4. Do not make Agent automation status a blocking health requirement for lottery analysis. 5. Refuse cross-profile database paths even when running as SYSTEM. 6. Open the permitted database in read-only mode using a SQLite URI. 7. Query only the minimum required rows and columns. 8. Log which database path is being inspected and require user confirmation when it differs from the current profile. 9. Separate host-integration diagnostics from the default report-generation pipeline.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lib/dlt_smart.py:402
• Finding: Default Pipeline Modifies Desktops and Skill Artifacts Across Windows User Profiles## Vulnerability Details **File Location**: `scripts/run_dlt.py:83-100` and `143-174`; `scripts/lib/dlt_smart.py:402-474` **Vulnerability Type**: Cross-profile filesystem modification **Risk Level**: High ### Vulnerable Code ```python def _detect_real_desktop(): users_root = os.path.expandvars(r"%SystemDrive%\Users") if not os.path.isdir(users_root): return None skip = ( "public", "default", "default user", "defaultuser0", "all users", "systemprofile", "network service", "local service", ) for name in os.listdir(users_root): if name.lower() in skip: continue desktop = os.path.join(users_root, name, "Desktop") if os.path.isdir(desktop): return desktop ``` ```python for pattern in ( "DLT-period-prediction-report.html", "DLT-period-draw-check-report.html", ): for path in glob.glob(os.path.join(desktop, pattern)): destination, note = _safe_move(path, desktop_archive) ``` The source uses localized report filename patterns, but the operation is an overwrite-capable move into an archive directory: ```python def _safe_move(src, dst_dir): os.makedirs(dst_dir, exist_ok=True) dst = os.path.join(dst_dir, os.path.basename(src)) try: os.replace(src, dst) return dst, None except Exception: shutil.copy2(src, dst) return dst, "copied" ``` The engine also discovers Skill installations under every enumerated profile and copies generated artifacts into them: ```python def _candidate_peer_libs(work_dir): cands = [] for profile in _iter_real_user_profiles(): cands.append(os.path.join( profile, ".workbuddy", "skills", "dlt-probability-analyzer", "scripts", "lib", )) return cands ``` ```python for p ...[truncated 2604 chars]
• Remediation: ## Remediation Suggestions 1. Never discover output destinations by scanning every local user profile. 2. Require the report destination to be explicitly supplied by the invoking user or host. 3. Restrict all writes to the current Skill directory and current user's approved output directory. 4. Remove automatic peer-installation synchronization. 5. If artifact synchronization is required, use a user-selected destination and explicit confirmation. 6. Do not move or overwrite existing desktop files automatically. 7. Use unique, non-colliding filenames and fail safely when a destination already exists. 8. When running non-interactively, write to a dedicated service-owned output directory rather than another user's desktop. 9. Avoid SYSTEM execution so normal filesystem access controls remain effective. 10. Add tests asserting that no resolved path escapes the current profile or installation root.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (65)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"未找到已生成报告(交由看门狗巡检排程), 本次跳过完整性断言")
        return
    try:
        r = subprocess.run(
            [PYTHON, "-c",
             f"from verify_report_sections import verify_report; "
             f"import sys; sys.exit(1 if verify_report(r'{target}', enhanced={enhanced}, verbose=False) else 0)"],

• Confidence: 96% confidence
• Finding: This code builds Python code with an f-string and passes it to `python -c`, embedding `target` directly into the code string. If a crafted filename contains quotes or Python syntax, it can break out of the raw string literal and execute arbitrary Python code during the health check; because filenames in the working directory influence `target`, this is a realistic local code-execution sink.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"    (dry) 将执行: schtasks /create /tn {TASK_NAME} /xml {xml} /f")
        return True, "dry-run: 未执行"
    try:
        r = subprocess.run(
            ["schtasks", "/create", "/tn", TASK_NAME, "/xml", xml, "/f"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=30,
        )

• Confidence: 93% confidence
• Finding: The code invokes the Windows `schtasks` utility to create a scheduled task from an XML file found in the backup directory. Even though it avoids shell injection by passing an argument list, it still restores a persistence mechanism from externally supplied backup content, which can create or reintroduce privileged scheduled execution unrelated to the lottery-analysis purpose of the skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("    (dry) 将执行: python build_dist.py")
        return
    try:
        r = subprocess.run(
            [PYTHON, bd], cwd=WORK_DIR, capture_output=True, text=True,
            timeout=900, encoding="utf-8", errors="replace",
            env={**os.environ, "PYTHONUTF8": "1", "PYTHONIOENCODING": "utf-8"},

• Confidence: 79% confidence
• Finding: The script executes `build_dist.py` from the workspace during restore, which adds arbitrary local code execution as part of a recovery flow. Because the target file is discovered from disk rather than embedded and verified, a tampered workspace could cause unexpected code to run during restoration, expanding the skill beyond its declared purpose.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return
        print("  🔧 检测到 Root↔SKILL 不一致, 自动同步四体 + 重建基线 ...")
        root_dir = os.path.dirname(WORK_DIR)
        r1 = subprocess.run([PYTHON, os.path.join(root_dir, "build_dist.py")],
                            cwd=root_dir, capture_output=True, text=True,
                            timeout=600, encoding="utf-8", errors="replace")
        print(f"    build_dist: rc={r1.returncode}")

• Confidence: 91% confidence
• Finding: The script automatically executes `build_dist.py` from a parent directory outside the skill working tree. In this skill, that behavior is part of a self-deployment/self-healing mechanism that crosses installation boundaries, so if that file or parent path is tampered with, the skill will execute attacker-controlled code with the agent's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(r1.stdout[-500:])
        if r1.stderr:
            print(f"    [build_dist STDERR] {r1.stderr[-300:]}")
        r2 = subprocess.run([PYTHON, "dlt_self_integrity.py", "--init"],
                            cwd=WORK_DIR, capture_output=True, text=True,
                            timeout=300, encoding="utf-8", errors="replace")
        print(f"    self_integrity --init: rc={r2.returncode}")

• Confidence: 84% confidence
• Finding: This call rebuilds integrity baselines automatically via `dlt_self_integrity.py --init`, which weakens the value of integrity checks by allowing the skill to reset its own trusted state. An attacker who has already modified local files could abuse this to normalize tampered content and suppress later detection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"}catch{msg * $m}"
    )
    try:
        subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=30,
        )

• Confidence: 83% confidence
• Finding: The code launches PowerShell with a dynamically constructed script string, and the alert message incorporated into that script is derived from `reasons`, which can include external command output and file contents. Although `_ps_escape` reduces basic quote-breaking risk, passing attacker-influenced content into a PowerShell `-Command` string is still a dangerous pattern because parsing quirks or future changes could turn status text into script injection or abusive desktop notification behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises no declared permissions, yet its documentation instructs shell execution, network access, reading/writing files, and interacting with environment-dependent paths. This undermines permission transparency and can cause the agent to perform materially more sensitive actions than a reviewer or user would expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented behavior extends well beyond a lottery-analysis assistant into scheduled-task inspection, watchdog behavior, report delivery, backup/state handling, code integrity checks, and local ledger functions. This mismatch increases the risk of overprivileged execution and hides system-management features inside an entertainment skill, making abuse or unintended side effects more likely.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill claims 'pure local' and 'zero exfiltration' while also describing routine downloads from multiple external sources. Even if user data is not uploaded, this is a deceptive security claim that can mislead users and reviewers about network behavior and trust boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The operations document introduces persistent Windows scheduled-task automation, SYSTEM execution, and watchdog behavior that go well beyond the declared purpose of a lottery-analysis skill. In this context, hidden or undocumented host automation materially expands the skill's operational scope and creates a pathway for background execution on the user's machine without a clear user-facing need.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This section documents inspecting and repairing Windows scheduled-task settings, including operational checks against LastTaskResult and deployment-specific remediation. For a lottery recommendation skill, this is context-inappropriate system-management capability that could normalize or facilitate host persistence and task manipulation outside the user's reasonable expectations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The document provides administrator-level PowerShell commands to modify a SYSTEM scheduled task, including battery, idle-stop, and execution-limit settings. Giving privileged host-modification instructions that are unrelated to the skill's stated end-user purpose increases the risk of unauthorized persistence, degraded system policy, and broader abuse if copied or followed blindly.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Persisting watchdog conclusions and alert files tied to task-result surveillance is not justified by the advertised lottery-analysis function. Even though the files appear operational rather than overtly malicious, this behavior supports background monitoring and stateful host interaction that exceeds the expected scope of an entertainment analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The README explicitly documents publishing the skill to external platforms such as clawhub.ai and skillhub.cn, which is outside the narrow end-user purpose of lottery analysis. Any built-in deployment/distribution capability expands the blast radius of a compromised or unsafe skill by enabling rapid propagation to third-party platforms, and the surrounding document shows a pattern of broad operational control beyond simple analysis.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The README describes direct mutation of Windows scheduled-task configuration, including changing runtime identity and task settings. That is a privileged operational capability unrelated to lottery-number entertainment itself, and if exposed through the skill or its automation path it could be abused for persistence, stealthy execution, or unauthorized system reconfiguration.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill silently performs state-changing local actions beyond lottery analysis by automatically recording user spending and applying budget-guard behavior. Even though framed as a safety feature, it writes persistent user-behavior data without explicit consent or clear separation from the advertised analysis function, creating privacy and surprise side-effect risks.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The code adds outlet radar and optional IP-based city detection, which expands the skill from lottery analysis into network-based location inference. That creates unnecessary collection/use of location-related data not required for the core function, increasing privacy exposure and attack surface.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The report export logic copies files onto the user's desktop and actively searches for a 'real' desktop path, causing unprompted writes outside the skill's working area. This exceeds expected scope, can leak sensitive report contents into a visible/shared location, and violates least surprise by modifying user filesystems without explicit approval.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The function scans the system's user directories to discover a non-system 'real' desktop, which is unrelated to the declared lottery-analysis purpose and exposes information about local accounts and filesystem layout. Enumeration of user profiles is a privacy-invasive capability and can be abused for reconnaissance in a broader compromise chain.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The backup helper reads SKILL.md from a user-level ~/.workbuddy/skills directory outside the immediate project tree to extract a version string. That broadens trust boundaries and allows unrelated local files or symlinked content to influence backup metadata, which can leak information about user environment layout or permit metadata spoofing if an attacker can plant or modify that file.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code and docstring assert that malformed inputs to passes_filters will be rejected by returning False, but the implementation only evaluates heuristic conditions and does not validate length, uniqueness, range, or type before applying them. As a result, some invalid combinations can be accepted or can trigger inconsistent behavior, undermining any downstream logic that treats this function as a validator or safety gate.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script writes a generated HTML report to a Desktop path without an explicit user-provided destination or clear necessity for the skill’s core function. Persisting files to a user-visible location is a side effect that exceeds simple analysis and recommendation behavior, and could surprise users or be abused to drop unsolicited content on the host.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The function enumerates user profile directories under the system drive to find a 'real' Desktop, which is unnecessary for a lottery-analysis tool and materially broadens host inspection scope. Cross-user directory scanning can expose information about local accounts and enables file placement into another user’s workspace, creating a stronger privacy and unauthorized-access concern than a normal single-user export.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The final summary prints a blanket success statement ('三方交叉验证全部通过') regardless of the actual PASS/FAIL state. In a validation script, this can mislead operators into trusting outputs that failed one or more checks, undermining the integrity controls the script is supposed to provide.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Although the comments say hardcoded valid-combo counts were removed, the final summary still compares against a fixed value of 38537. This creates a false sense of correctness and can cause the report to mark dynamic validation as failed or inconsistent based on stale constants rather than current recomputation.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/lib/dlt_outlet_map.py:37