双色球一站看

• Outcome: Review
• Latest audit: Sep 7, 2026 · 6:31 AM UTC
• Version: 2.1.51

Overview

The skill mostly generates lottery reports, but it also directs privileged background automation and scans or writes across local user profiles, which is too much authority for that purpose.

Install only if you are comfortable with a lottery-report tool running Python scripts that access the network, write local reports, and inspect WorkBuddy/local profile state. Do not follow the SYSTEM scheduled-task instructions on a shared machine; use a current-user, explicit-output setup or an isolated environment, and avoid granting administrator privileges.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: references/operations.md:106
• Finding: SYSTEM-level scheduled-task persistence exceeds functional requirements<![CDATA[ ## Vulnerability Details **File Location**: `references/operations.md:106-111` **Vulnerability Type**: Privileged scheduled-task persistence **Risk Level**: High ### Vulnerable Code or Configuration ```text ## 5. Windows 计划任务配置（ssq_run_v8.bat + schtasks） > ⚠️ 发布包不含 ssq_run_v8.bat（SkillHub 等平台禁用 .bat 等可执行脚本）。 > 下面的 bat 仅适用于本机 Windows 部署。 - 任务名 SSQ_V1_Smart： schtasks /create /tn SSQ_V1_Smart /tr "绝对路径\ssq_run_v8.bat" /sc weekly /d MON,WED,SAT /st 20:10 /ru SYSTEM /rl highest - bat 第 10 行 /ru SYSTEM，确保无论登录都跑；含 WakeToRun / RestartOnFailure / StartWhenAvailable。 ``` The package does not directly execute `schtasks /create`, but its official operational instructions explicitly direct users to install a recurring task under the Windows `SYSTEM` account with the highest run level. ### Technical Analysis Lottery analysis, public-data retrieval, and HTML report generation do not require administrative or `SYSTEM` privileges. A current-user scheduled task is sufficient if optional automatic report generation is desired. The documented command creates a persistent execution mechanism that: - Survives the Skill invocation and user logout. - Runs whether or not an interactive user is logged in. - Executes the batch file and all downstream Python scripts as `SYSTEM`. - Uses `RestartOnFailure` and `StartWhenAvailable`, increasing persistence. - Gives all future versions or modified copies of invoked scripts machine-level privileges. This violates least-privilege principles and significantly amplifies other filesystem and cross-profile behaviors in the project. ### Attack Path 1. A user follows the Skill's Windows deployment instructions. 2. The user runs the documented `schtasks /create` command with administrative authorization. 3. Windows registers `SSQ_V1_Smart` to execute as `SYSTEM` at recurring times. 4. The task invokes `ssq_run_v8.bat`, which launches the report-generation pipeline. 5. All scripts, network processing, profile enumeration, databa ...[truncated 541 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `SYSTEM` and highest-run-level deployment instructions. 2. Do not enable scheduling by default or represent it as an integral part of report generation. 3. If scheduling is offered, require explicit informed user consent and create the task under the current user without elevation. 4. Use a narrowly scoped output directory owned by that user. 5. Do not enable `WakeToRun`, automatic restart, or execution while logged out unless the user separately opts into each behavior. 6. Provide documented removal and status commands for every scheduled task. 7. Keep scheduling outside the core Skill package so ordinary report generation never requires administrative privileges. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lib/ssq_healthcheck_all.py:100
• Finding: Default health check enumerates user profiles and reads another user's WorkBuddy database<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/ssq_healthcheck_all.py:100-151, 732-754, 1002-1059` **Vulnerability Type**: Cross-account application-state access **Risk Level**: High ### Vulnerable Code ```python if os.path.isdir(root): skip = ("public", "default", "default user", "defaultuser0", "all users", "systemprofile", "network service", "local service") try: for name in os.listdir(root): nl = name.lower() if nl in skip or nl.startswith("systemprofile"): continue d = os.path.join(root, name) if os.path.isdir(d): yield d except Exception: pass ``` ```python def _candidate_workbuddy_dbs(): """WorkBuddy automation database candidate paths.""" cands = [os.path.expanduser("~/.workbuddy/workbuddy.db"), os.path.expandvars(r"%USERPROFILE%\.workbuddy\workbuddy.db")] for p in _iter_real_user_profiles(): cands.append(os.path.join(p, ".workbuddy", "workbuddy.db")) return cands ``` ```python db = None for _cand in _candidate_workbuddy_dbs(): if _cand and os.path.exists(_cand): db = _cand break if db: con = sqlite3.connect(db) con.row_factory = sqlite3.Row for r in con.execute("SELECT name FROM automations").fetchall(): nm = r["name"] or "" if "双色球" in nm: mm = re.search(r'V(\d+\.\d+\.\d+)', nm) if mm and mm.group(1) != cur: issues.append( f"WorkBuddy automation name '{nm}' version " f"{mm.group(1)} != current {cur}" ) con.close() ``` The additional synchronization check executes: ```python cur.execute( "SELECT id, status, name FROM automations " "WHERE (deleted_at IS NULL OR deleted_at=0)" ) rows = cur.fetchall() ``` ### Technical Analysis The health check searches every non-system profile under the Windows users directory and uses ...[truncated 1833 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all enumeration of `%SystemDrive%\Users`. 2. Resolve WorkBuddy state only from the current user's profile or an explicit path supplied by that user. 3. Validate that the selected database is owned by the invoking account and belongs to the current Skill installation. 4. Make WorkBuddy integration optional and disabled by default. 5. Do not make external Agent-state inspection a blocking report-generation health check. 6. When running non-interactively, fail closed or skip the integration instead of searching other profiles. 7. Avoid logging automation identifiers or names unless the user explicitly requests a diagnostic report. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/lib/ssq_smart.py:337
• Finding: Default pipeline writes prediction artifacts into Skill installations belonging to other users<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/ssq_smart.py:337-441, 510-516` **Vulnerability Type**: Unauthorized cross-account filesystem modification **Risk Level**: High ### Vulnerable Code ```python def _iter_real_user_profiles(): """Generate real interactive-user profile roots.""" root = os.path.expandvars(r"%SystemDrive%\Users") if os.path.isdir(root): skip = ("public", "default", "default user", "defaultuser0", "all users", "systemprofile", "network service", "local service") try: for name in os.listdir(root): nl = name.lower() if nl in skip or nl.startswith("systemprofile"): continue d = os.path.join(root, name) if os.path.isdir(d): yield d except Exception: pass ``` ```python def _candidate_peer_libs(work_dir): cands = [] for p in _iter_real_user_profiles(): cands.append(os.path.join( p, ".workbuddy", "skills", "ssq-probability-analyzer", "scripts", "lib" )) wb = os.path.join(p, "WorkBuddy") if os.path.isdir(wb): try: for sub in os.listdir(wb): rp = os.path.join(wb, sub) if (os.path.isdir(rp) and os.path.exists(os.path.join( rp, "lib", "ssq_smart.py" ))): cands.append(os.path.join(rp, "lib")) except Exception: pass return cands ``` ```python for peer in peers: ok = 0 for src in files: try: _sh.copy2(src, os.path.join(peer, os.path.basename(src))) ok += 1 except Exception as e: print( f"Mirror to {peer} failed for " f"{os.path.basename(src)}: ...[truncated 2161 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `sync_products_to_peers` from the default pipeline. 2. Never enumerate other users' profiles to discover Skill installations. 3. Keep generated artifacts inside the current installation and a user-selected output directory. 4. If synchronization is a required advanced feature, expose a separate command that accepts an explicit destination and requires confirmation. 5. Verify destination ownership and permissions before copying. 6. Refuse cross-account destinations, including when the process has administrative or `SYSTEM` privileges. 7. Use collision-resistant export filenames or explicit overwrite confirmation. 8. Add tests proving that a normal run cannot write outside the current user's configured directories. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/run_ssq.py:79
• Finding: Desktop auto-detection can write reports into an unrelated user's profile<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run_ssq.py:79-118, 145-174` **Vulnerability Type**: Unsafe cross-account output-path selection **Risk Level**: Medium ### Vulnerable Code ```python def _detect_real_desktop(): """Locate a real interactive-user desktop under SYSTEM.""" users_root = os.path.expandvars(r"%SystemDrive%\Users") if not os.path.isdir(users_root): return None skip = ("public", "default", "default user", "defaultuser0", "all users", "systemprofile", "network service", "local service") try: for name in os.listdir(users_root): nl = name.lower() if nl in skip or nl.startswith("systemprofile"): continue d = os.path.join(users_root, name, "Desktop") if os.path.isdir(d): return d except Exception: pass return None ``` ```python desktop = _resolve_desktop() enhanced_desktop = base_desktop = None chosen_abs = None if desktop: for src, holder in ((enhanced, "enhanced_desktop"), (base, "base_desktop")): if not src: continue try: dest = os.path.join(desktop, os.path.basename(src)) shutil.copy2(src, dest) absdest = os.path.abspath(dest) if holder == "enhanced_desktop": enhanced_desktop = absdest chosen_abs = absdest else: base_desktop = absdest if not chosen_abs: chosen_abs = absdest try: fixed = os.path.join( desktop, "双色球分析报告_最新.html" ) shutil.copy2(src, fixed) except Exception: pass ``` ### Technical Analysis The desktop resolver returns the first non-system profile directory containing a `Desktop` folder. Directory enumeration order is not a reliable indication of: - The active inte ...[truncated 1357 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default output to a directory owned by the current invoking user. 2. Accept an explicit `--output-dir` argument for scheduled or non-interactive execution. 3. Do not infer the recipient by returning the first profile found under the Windows users directory. 4. If interactive-session resolution is required, use a trusted operating-system API and verify the resolved account and directory ownership. 5. Refuse desktop delivery when no unambiguous requesting user can be identified. 6. Avoid fixed filenames unless the user explicitly approves overwriting. 7. Perform atomic writes and report destination and overwrite decisions clearly. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/ssq_huiniao_api.py:24
• Finding: Lottery history is retrieved over unauthenticated plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/ssq_huiniao_api.py:24-29, 61-65` **Vulnerability Type**: Plaintext network transport for integrity-sensitive data **Risk Level**: Medium ### Vulnerable Code ```python url = f"http://api.huiniao.top/interface/home/lotteryHistory?type=ssq&page={page}&limit={limit}" req = urllib.request.Request(url, headers={ ``` ```python with urllib.request.urlopen(req, timeout=15) as resp: ``` A second request uses the same plaintext endpoint: ```python url = "http://api.huiniao.top/interface/home/lotteryHistory?type=ssq&page=1&limit=100" req = urllib.request.Request(url, headers={ ``` ```python with urllib.request.urlopen(req, timeout=15) as resp: ``` ### Technical Analysis The source uses HTTP rather than HTTPS. HTTP provides neither server authentication nor transport integrity. Any network-path attacker, compromised access point, proxy, or DNS manipulation can alter the response before it reaches the parser. The retrieved history influences generated statistical analysis and recommended combinations. If the response is cached or written into local history, manipulated input may persist beyond the immediate run. No sensitive user information was observed being uploaded to this endpoint. The principal risk is response manipulation rather than confidentiality loss. ### Attack Path 1. The default online pipeline requests lottery history from `api.huiniao.top` over HTTP. 2. An attacker able to intercept or redirect the network connection returns manipulated history data. 3. The client accepts the response without TLS server authentication. 4. The manipulated records enter the lottery-analysis pipeline. 5. Reports, statistics, freshness checks, and recommendations are produced from attacker-controlled data. 6. If the data is persisted, subsequent offline runs may continue using the corrupted dataset. ### Impact Assessment A network-positioned attacker can compromise report integrity and mislead user ...[truncated 232 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the endpoint with an HTTPS equivalent. 2. If the provider does not support HTTPS, remove it from the automatic source list. 3. Prefer an authenticated official lottery source. 4. Validate response schema, period format, dates, number ranges, uniqueness, and ordering. 5. Cross-check newly received draws against at least one independent HTTPS source before persistence. 6. Do not overwrite trusted local history when sources disagree. 7. Record source provenance and integrity-validation results in the fetch log. 8. Treat redirects from HTTPS to HTTP as failures. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (62)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

py = sys.executable
        script = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ssq_photo_fetcher.py")
        # 非阻塞启动：不 wait，子进程在后台自行完成（受 socket 超时保护，最坏约 1~2 分钟）
        subprocess.Popen([py, script],
                         stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                         creationflags=0x00000008)  # DETACHED_PROCESS：脱离父进程，父退出不影响
    except Exception:

• Confidence: 92% confidence
• Finding: The code launches a detached background subprocess (`ssq_photo_fetcher.py`) with no interactive confirmation and no robust visibility to the caller. Even though the target script path is fixed, spawning an unmonitored child process from a lottery-analysis skill expands execution scope beyond analysis into host-side persistence and network activity, which is risky in an agent environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if '--serve' in sys.argv:
        try:
            import subprocess as _sp
            _sp.Popen(
                [sys.executable, os.path.join(HERE, 'ssq_serve.py')],
                cwd=HERE, stdout=_sp.DEVNULL, stderr=_sp.DEVNULL,
            )

• Confidence: 89% confidence
• Finding: The skill can start a local HTTP service process (`ssq_serve.py`) from the host machine. Opening a listener, even on localhost, is a meaningful privilege expansion for a lottery-analysis skill and may expose local state or create an unexpected IPC surface, especially if other local processes or browser contexts can reach it.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"未找到已生成报告(交由看门狗巡检排程), 本次跳过完整性断言")
        return
    try:
        r = subprocess.run(
            [PYTHON, "-c",
             f"from verify_report_sections import verify_report; "
             f"import sys; sys.exit(1 if verify_report(r'{target}', enhanced={enhanced}, verbose=False) else 0)"],

• Confidence: 86% confidence
• Finding: This call builds Python code with an f-string and passes it to `python -c`, interpolating `target` directly into executable source. If a filename inside WORK_DIR contains a quote or crafted characters, the generated Python snippet can be broken out of the raw string literal and arbitrary Python code can execute during the healthcheck.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"}catch{msg * $m}"
    )
    try:
        subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=30,
        )

• Confidence: 85% confidence
• Finding: The code launches PowerShell to execute a dynamically constructed script string. Although the current message content is mostly derived from internal constants and `_ps_escape` reduces obvious quoting issues, using `powershell -Command` increases attack surface and can become dangerous if any future reason strings or task metadata become attacker-influenced, enabling script injection or unsafe OS-level actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares no permissions, yet the documentation instructs use of shell execution, network access, environment inspection, and file read/write to local paths such as the desktop. This creates a capability-transparency failure: users and hosting systems may treat the skill as low-risk on-demand content, while it can actually execute broad local actions and reach external sites.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented role is a lottery analysis assistant, but the skill also describes broader system-management behavior: scheduled-task/watchdog handling, profile/desktop scanning, integrity/self-healing logic, packaging, and auxiliary testing infrastructure. This mismatch is dangerous because it obscures the real attack surface and normalizes unrelated privileged behavior under an entertainment use case.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as an on-demand assistant, but the documentation says it installs or depends on always-on automation that runs before and after draws. Persistent background execution changes the trust model materially and can surprise users with repeated local activity, file writes, and network access outside an active session.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill claims 'purely local, zero exfiltration,' but elsewhere it clearly performs live retrieval from external lottery data sources. Even if the network use is only download-oriented, the contradictory privacy claim can mislead users and reviewers about when the host contacts outside services and what metadata may be exposed.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The operations document defines scheduled execution and watchdog automation that extend the skill from user-invoked lottery analysis into persistent local task orchestration. That is dangerous because it creates hidden automation behavior and system-state monitoring outside the user-facing purpose, increasing surprise, attack surface, and the chance of unauthorized persistence if the broader skill stack acts on these instructions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section documents inspecting and modifying Windows Task Scheduler settings, including administrator-elevated changes to SYSTEM-run tasks. In the context of a lottery-analysis skill, that capability is not justified and is dangerous because it normalizes privileged local system modification, which could be repurposed for persistence, stealthy execution hardening, or weakening a host's operational controls.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The document requires local persistence of watchdog conclusions and alert files, which introduces durable host-side state unrelated to the core entertainment analysis function. Persistent alert/status files can expose system execution details, create covert signaling or coordination channels, and expand the skill's operational footprint beyond what users would reasonably expect from this stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code writes reports and related artifacts to the local filesystem and copies them to the user's desktop for delivery/persistence, which exceeds the stated analysis/checking purpose. In an agent skill context, unexpected host writes to user-visible locations can leak data, clutter the system, and violate user expectations about what the skill is allowed to modify.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Launching auxiliary processes and local services is unjustified for a lottery-analysis skill and materially increases host-side attack surface. In this context, the mismatch between declared purpose and actual behavior makes the subprocess behavior more dangerous because users and orchestrators are less likely to expect execution, persistence, or service startup.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The function documentation explicitly promises that invalid inputs will be rejected by returning False without raising exceptions, but the implementation performs no structural validation before calling operations like max(), min(), arithmetic, and membership checks. Malformed or adversarial inputs can therefore trigger exceptions or produce misleading results, creating a denial-of-service and reliability issue anywhere this function is used as a supposedly safe validator in the skill pipeline.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The HTML explicitly states that 'statistically cold' numbers have a slightly higher rebound probability, which contradicts the surrounding disclaimer that past draws do not predict future outcomes. In a lottery-analysis skill, this can mislead users into believing the system has identified an edge, encouraging gambling decisions based on a false statistical premise.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code enumerates system user profile directories to locate a 'real' desktop and then writes files there, which exceeds the minimal access needed for a lottery checking tool. In an agent/skill context, this is dangerous because it reaches outside the app's working area into host-user environments, enabling unintended data placement, privacy boundary crossing, or abuse as a foothold for broader host interaction.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module is presented as a verification/reporting component, but in auto mode it fetches remote data and overwrites the local historical results file. That hidden state mutation increases risk because a network-fed source can alter future behavior and persisted data without a clear trust boundary, audit trail, or user approval.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script copies the generated report to a detected desktop path outside the main output location, which is a side effect unrelated to core lottery analysis. This can place files into another user's visible workspace without clear consent, creating privacy, surprise-write, and policy-boundary issues, especially when the script runs under elevated or scheduled contexts.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The `_detect_real_desktop()` function enumerates `%SystemDrive%\Users` and searches other user profiles to find an interactive user's Desktop. For a lottery-analysis skill, that capability is unnecessary and broadens access beyond the current execution context, which can enable cross-user targeting and unauthorized file placement when run with sufficient privileges.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code writes persistent gambling-related artifacts such as ssq_valid_combos.json and later creates betting/tracking files and recommendation outputs that move beyond neutral probability analysis into operational betting support. In this skill context, that increases behavioral risk because the manifest frames the tool as entertainment and explanation, but the implementation materially facilitates repeated wagering workflows.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This section provides bankroll-management and stake-sizing guidance, including percentage-of-income spend caps and stop-loss style advice, which operationalizes gambling rather than merely analyzing probabilities. In a lottery recommendation skill, this is more dangerous because it can normalize repeated betting and give users a false sense of controlled financial risk despite the code itself acknowledging negative expected value.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code generates concrete胆拖 betting schemes with selected numbers, combination counts, and exact cost calculations, which directly supports bet construction and purchase planning. Given the skill description's entertainment framing, this crosses into actionable gambling enablement and could encourage users to place more complex or larger wagers.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The function `build_resident_expert_panel` fabricates deterministic but synthetic 'expert' picks for named real experts when live data is unavailable, which can mislead users into believing the recommendations were actually made by those experts. Even though the module includes disclaimers, attributing generated numbers to specific experts creates a provenance/integrity problem that is especially risky in a gambling-related skill where users may act on perceived authority.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The random baseline is intended to be the comparator for expert picks, but it uses a different选号 structure than the expert data and the documented 双色球 rules. This makes the baseline statistically inconsistent, so the system can misstate whether experts outperform randomness and may systematically mislead users about gambling-related recommendations.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring says the function generates a '6+1' random baseline, but the implementation actually samples 6 front and 3 back numbers. This documentation/code mismatch is dangerous because it hides a logic flaw in the core comparison method, causing analysts or downstream code to trust invalid output and potentially present incorrect gambling advice or performance claims.

Static analysis

No suspicious patterns detected.