大乐透概率分析器 · 95%彩民都该看的真相

• Outcome: Review
• Latest audit: Aug 24, 2026 · 12:15 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a lottery report tool, but it also includes broad Windows scheduling, WorkBuddy, user-profile, and persistence-related behavior that users should review carefully before installing.

Install only if you are comfortable with a Python skill that can fetch lottery and expert data from the network, write reports onto your desktop, inspect WorkBuddy automation state, query or restore Windows scheduled tasks, and participate in SYSTEM/watchdog-style automation. For a normal user, prefer manual `python run_dlt.py` use and avoid enabling scheduled tasks, watchdogs, restore, or admin PowerShell steps unless you have reviewed them.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (91)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"未找到已生成报告(交由看门狗巡检排程), 本次跳过完整性断言")
        return
    try:
        r = subprocess.run(
            [PYTHON, "-c",
             f"from verify_report_sections import verify_report; "
             f"import sys; sys.exit(1 if verify_report(r'{target}', enhanced={enhanced}, verbose=False) else 0)"],

• Confidence: 94% confidence
• Finding: This subprocess invocation builds Python code with an f-string and passes it to `python -c`, embedding the `target` path directly into executable code. If the report filename contains quotes or crafted characters, it can break out of the string literal and execute arbitrary Python code; since filenames in the working directory are attacker-influenced inputs in a hostile skill environment, this is a genuine code-injection risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"}catch{msg * $m}"
    )
    try:
        subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=30,
        )

• Confidence: 80% confidence
• Finding: The code launches PowerShell to display an OS-level alert, which expands the skill from passive lottery analysis into host-level execution. Although the message is partly escaped and not obviously user-controlled here, invoking `powershell -Command` increases attack surface and can become dangerous if upstream data ever reaches `reasons` or if the execution environment is manipulated.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while instructing execution of code that uses shell execution, network access, environment inspection, and extensive file read/write operations. This undermines least-privilege review and informed consent, because a host may invoke a skill with capabilities the user and platform reviewer were not clearly told it needs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is lottery analysis and harm reduction, but the skill also directs broad operational behavior: downloading from external sources, scraping expert content, copying files to user desktops, interacting with scheduled tasks and WorkBuddy databases, syncing artifacts across installs, and maintaining watchdog/recovery workflows. That mismatch is dangerous because users or orchestrators may grant trust appropriate for a simple analysis skill while it performs system-management actions far outside that scope.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The README describes using administrator-privileged PowerShell to modify Windows scheduled-task settings, which is unnecessarily high privilege for a lottery-analysis skill and creates host-level persistence/automation capability. In an agent-skill context, instructions normalizing admin task modification are dangerous because they can enable privileged persistence, reduce user visibility, and be repurposed beyond the stated lottery purpose.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The changelog shows the skill expanding into broad web collection, expert aggregation, and external-content injection that goes beyond the declared harm-reduction lottery analysis scope. Scope creep like this increases attack surface, creates opportunities for untrusted remote content to influence outputs, and can mislead reviewers or users about what the skill actually does.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The file documents parallel subprocess launching and process orchestration that are not obviously necessary for a lottery-analysis skill. Even if intended for performance, broad subprocess management increases execution complexity and can be abused for unintended command execution, resource exhaustion, or hiding behavior outside the main skill flow.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The changelog describes inspecting scheduled tasks, parsing task XML, evaluating runtime health, and providing PowerShell-based task-setting repair for Windows. In the context of a lottery-analysis skill, this is materially over-privileged and can enable host persistence, stealthy automation, or system configuration changes unrelated to the user-facing purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest markets the skill as an honest probability and harm-reduction assistant, but the code header and later logic clearly implement automated lottery prediction, scoring, and recommended number generation. This mismatch is dangerous because it undermines user trust and safety controls, making users more likely to rely on prohibited or misleading gambling guidance despite explicit claims that no predictive edge exists.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The metadata says the outlet radar is city-level and does not collect precise location, but the code enables automatic city detection via the user's IP. Even if only city-level output is ultimately shown, deriving location from IP without clear consent expands data collection beyond the stated behavior and creates a privacy mismatch.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code scans system user profile directories to locate a 'real' desktop and copies generated reports there automatically. That behavior exceeds the apparent scope of a lottery-analysis skill, crosses user-boundary assumptions on multi-user systems, and can write files into locations the current user did not explicitly approve.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Launching a second Python process to generate an enhanced report adds unnecessary execution capability for this skill type and broadens the trust boundary to another script. While not directly injectable here, it increases the chance of abuse if the companion script is modified, replaced, or behaves unexpectedly.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation repeatedly frames features as 'non-predictive' and 'descriptive only,' yet the implementation generates grouped recommendations, scoring,胆拖 optimization, and report outputs that are plainly prescriptive. This deceptive framing is dangerous in a gambling context because it can circumvent policy expectations and encourage reliance on betting advice while appearing safety-oriented.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The backup script reads a user-level WorkBuddy skill manifest from the home directory, reaching outside the skill's working tree into unrelated per-user data. In the context of a lottery-analysis skill, that scope expansion is suspicious because it enables collection of metadata from other installed skills and broadens access beyond the declared purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements disaster-recovery backup, state snapshotting, ZIP archiving, and Windows scheduled-task export rather than lottery probability analysis. This mismatch is dangerous because users invoking a seemingly analytical skill may unknowingly grant a component access to operational state, task definitions, and packaged data unrelated to the promised function, increasing the risk of covert collection or persistence support.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The code and comments/assertions state that malformed combinations should be rejected with False, but passes_filters performs no explicit shape, range, or uniqueness validation before applying heuristic checks. As a result, some invalid inputs can satisfy the numeric predicates and be treated as valid, which can corrupt downstream analysis, self-tests, and any decision logic that assumes inputs were sanitized.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code writes an HTML report to a local Desktop path without user confirmation, and it goes beyond the declared role of a lottery-analysis assistant by persisting files onto the host. Even if the content is not overtly malicious, unexpected local file writes can violate user expectations, leak sensitive output into shared environments, and create a foothold for social-engineering via generated files.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The helper scans system user profile directories to find a 'real' user's Desktop, explicitly bypassing the current execution context. That behavior is unrelated to lottery analysis and materially increases risk because it probes local accounts and targets another user's filesystem location for output, which can cross privilege or trust boundaries in scheduled-task/service environments.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The implementation ranks and recommends specific numbers using model scores despite the surrounding documentation claiming there is no predictive power. This mismatch is dangerous because it can mislead users into trusting pseudo-predictive output, undermining informed consent and potentially encouraging financial harm through deceptive or overstated guidance.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file is presented as a cross-validation script, but it invokes the production recommendation generator and reconstructs concrete lottery picks. In a safety-focused lottery skill whose stated purpose is harm reduction and debunking prediction claims, embedding recommendation generation inside a validator weakens separation of duties and can accidentally operationalize betting advice in contexts that were expected to be audit-only.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The comments and section headers repeatedly claim 'independent recomputation,' but the code actually calls the authoritative production pipeline (`DA.generate_predictions`). That misrepresentation undermines the integrity of the validation process: a bug, bias, or manipulation in the production generator can be mirrored by the validator, producing false assurance that the outputs were independently verified.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module claims mathematical honesty and says prediction has no edge, yet it still computes 'most reliable' numbers and presents model-weighted win probabilities as an optimization target. In a gambling-assistance context, this can mislead users into believing the system has predictive power despite the disclaimer, increasing risk of harmful spending and deceptive decision support.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The code deliberately injects deterministic perturbations so recommendations change across periods, specifically to avoid users noticing that outputs are similar. This is deceptive behavior because it manufactures novelty without new evidence, which can strengthen false beliefs that the model is adapting meaningfully and encourage continued gambling engagement.

Description-Behavior Mismatch

High

• Confidence: 84% confidence
• Finding: The `force` command can trigger network data retrieval from an arbitrary allowed source and then persist/overwrite local history without any confirmation, authorization boundary, dry-run mode, or scope restriction. In a skill whose stated purpose is end-user lottery analysis rather than system administration, this expands capability into operational state mutation and could let an invoking agent alter local datasets unexpectedly, affecting later analysis integrity and provenance.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: The file header advertises admin-style disaster recovery, forced source switching, and overwrite-based restoration features that are not justified by the declared user-facing skill purpose of rational lottery analysis. That capability mismatch increases the attack surface and creates an opportunity for misuse or accidental invocation, even if the code appears intended for maintenance rather than direct harm.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: dlt_outlet_map.py:37