双色球算法选号防被骗 · 理性选号助手 + 防割韭菜盾

• Outcome: Review
• Latest audit: Aug 24, 2026 · 1:02 PM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it bundles a lottery prediction/report pipeline with network scraping, local file writes, background helpers, and Windows SYSTEM scheduling guidance that deserve manual review before installation.

Install only if you are comfortable with a lottery-focused tool that fetches public online data, generates betting-style entertainment recommendations with no claimed edge, writes reports and caches locally, and may interact with Windows scheduling or local automation state. Avoid administrator/SYSTEM scheduled-task setup unless you intentionally want unattended local operation, and use the offline option if network access is not acceptable.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (100)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

py = sys.executable
        script = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ssq_photo_fetcher.py")
        # 非阻塞启动：不 wait，子进程在后台自行完成（受 socket 超时保护，最坏约 1~2 分钟）
        subprocess.Popen([py, script],
                         stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                         creationflags=0x00000008)  # DETACHED_PROCESS：脱离父进程，父退出不影响
    except Exception:

• Confidence: 90% confidence
• Finding: The code launches a detached background subprocess to run ssq_photo_fetcher.py without user confirmation, visible logging, or lifecycle control. Even though the script path is anchored to __file__, this still expands the skill's execution surface and can trigger unexpected network activity or resource use outside the main flow.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if '--serve' in sys.argv:
        try:
            import subprocess as _sp
            _sp.Popen(
                [sys.executable, os.path.join(HERE, 'ssq_serve.py')],
                cwd=HERE, stdout=_sp.DEVNULL, stderr=_sp.DEVNULL,
            )

• Confidence: 86% confidence
• Finding: The skill can spawn a local background service (ssq_serve.py) when invoked with --serve, creating a persistent listening process without interactive confirmation. In a skill environment, opening local services is higher risk than a normal CLI utility because it broadens attack surface and may expose state or data unexpectedly.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"未找到已生成报告(交由看门狗巡检排程), 本次跳过完整性断言")
        return
    try:
        r = subprocess.run(
            [PYTHON, "-c",
             f"from verify_report_sections import verify_report; "
             f"import sys; sys.exit(1 if verify_report(r'{target}', enhanced={enhanced}, verbose=False) else 0)"],

• Confidence: 98% confidence
• Finding: This code builds Python source for `python -c` by interpolating `target` directly into the command string. Although subprocess is invoked without a shell, a crafted filename containing quotes or Python syntax can break out of the raw string literal and execute attacker-controlled Python code when the healthcheck runs.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"}catch{msg * $m}"
    )
    try:
        subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=30,
        )

• Confidence: 88% confidence
• Finding: The code launches PowerShell to display native alerts, which expands the skill from passive analysis into OS-level execution. Although the displayed message is partially escaped and derived from internal reasons, invoking PowerShell increases attack surface and can be abused if any future data path allows untrusted content into the generated script or if the skill is run in a more privileged context.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents capabilities equivalent to shell execution, file read/write, network access, and environment access, yet declares no permissions. This creates a transparency and consent gap: a caller may invoke what appears to be a harmless educational skill while it can perform materially broader actions on the host and network.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior significantly exceeds the declared purpose: beyond education and verification, it performs prediction generation, external scraping, local file propagation, multi-script orchestration, scheduler/watchdog logic, and other unrelated interactive/stateful features. This mismatch is dangerous because it can cause overbroad invocation and lets a low-risk-seeming skill exercise much more powerful behaviors than a user or platform reviewer would reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill presents itself as privacy-preserving and rational-analysis-oriented, but it also performs live prediction generation and external expert/news scraping. Even if not overtly malicious, this inconsistency can mislead users about what data flows and behaviors occur during execution, especially when network fetches and third-party content are involved.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file explicitly claims 'pure local' and 'zero exfiltration' while elsewhere describing live connections to multiple online data sources and automatic refresh of stories/news. Contradictory security claims are dangerous because they undermine informed consent and can cause users or integrators to run networked code in environments where external access is prohibited or unexpected.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The execution memory shows the skill operationally collecting expert picks, generating prediction reports, and delivering them to users, which materially exceeds a stated purpose of rationality education and debunking. Even if disclaimers such as 'no_edge' are present, packaging and auto-delivering prediction artifacts can mislead users into treating the skill as an actionable forecasting tool, undermining safety boundaries and increasing fraud-enablement risk in a gambling context.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill claims that no number-selection strategy is better than random, but the recorded behavior still produces expert-pick prediction deliverables. This contradiction is dangerous because users are likely to infer endorsement or hidden efficacy from the mere existence of polished prediction outputs, which weakens the anti-scam positioning and can facilitate deceptive gambling advice despite nominal disclaimers.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The operations document explicitly describes an automated pipeline that produces '预测 + 报告' and '预测报告', which conflicts with the manifest's claim that the skill only performs honest statistical debunking and does not provide predictive capability. This mismatch is dangerous because it can mislead users, reviewers, or host platforms about the actual behavior and purpose of the skill, weakening trust and safety review controls.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document repeatedly frames generated artifacts as actionable prediction outputs even while the skill presents itself as an anti-scam, no-edge educational assistant. That creates a deceptive dual-use design: the declared safety posture says 'no predictive edge,' but the operational posture still centers production freshness, reporting, and delivery of prediction artifacts.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This section documents SYSTEM-level Windows scheduled-task administration, privileged settings changes, and local operational scripting that exceed the manifest's stated analytical purpose. Embedding host-level persistence and admin task-management guidance in a user-facing analytical skill increases the chance of unauthorized system modification, privilege misuse, and deployment of behavior outside expected platform scope.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The watchdog behavior monitors `LastTaskResult` and reads local logs and alert files, which goes beyond simple analytical processing and enters host-monitoring territory. In the context of a lottery-analysis skill, this extra monitoring capability is more suspicious because it is not necessary for the advertised end-user function and expands access to local execution state and files.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The launcher goes beyond its stated analysis purpose by copying generated files onto a user's desktop and writing cache, path, and log artifacts locally. This creates side effects on the host filesystem, may expose sensitive report contents to other local users, and can mislead users about the true scope of the tool's behavior.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code enumerates system user profile directories to locate a 'real' user's desktop, including behavior tailored for SYSTEM-context execution. That is more invasive than necessary for a lottery-analysis assistant and can result in writing files into another user's workspace, crossing privilege and user-boundary expectations on shared or managed Windows systems.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The module index advertises prediction generation, optimization, ML, expert scraping, and ranking features that materially conflict with the stated educational/no-edge posture. In a gambling-related skill, this mismatch can mislead users into believing the system has actionable predictive power despite the claimed statistical debunking, undermining informed consent and increasing risk of deceptive use.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Expert scraping, permanent expert rosters, and performance tracking are not necessary for a rationality/scam-prevention assistant and introduce persuasive authority mechanisms into a gambling context. Even if framed as analysis, these features can be repurposed to endorse particular tipsters or create an illusion of exploitable expertise, encouraging risky behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is marketed as a rational anti-scam assistant, but the code still automates generation, optimization, persistence, and presentation of actionable lottery picks and betting structures, including胆拖 optimization and prediction JSON/HTML outputs. That mismatch can mislead users into trusting the system as protective while it materially facilitates gambling decisions and increases behavioral risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file includes extensive gamification and retention mechanics—countdowns, scratch cards, wheels, streaks, levels, celebratory effects, mock jackpots, and interactive minigames—that are not necessary for anti-scam probability analysis. In the lottery context, these features can nudge repeated engagement and normalize or intensify gambling behavior despite the skill's stated cautionary framing.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Spawning auxiliary background subprocesses for media fetching is not justified by the core purpose of lottery probability education and anti-scam analysis. In a skill setting, unnecessary background execution increases operational and privacy risk, especially when paired with silent network refresh behavior.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code documents that malformed inputs to passes_filters should be rejected by returning False without raising, but the implementation relies on operations like max(), min(), set intersections, and helper functions that assume a valid 6-element numeric sequence. If upstream code trusts this contract and feeds malformed or adversarial input, it can trigger exceptions and crash analysis or report generation, creating a denial-of-service reliability issue rather than a direct code-execution flaw. In this skill context, that matters because the module presents itself as a single trusted source and self-check foundation for multiple scripts.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file explicitly imports and reuses a production 'prediction pipeline' and then validates its outputs against JSON/HTML artifacts, which means the skill is operationally supporting lottery-number recommendation rather than limiting itself to anti-scam education or randomness analysis. In this context, the danger is policy and trust misalignment: users and downstream systems may rely on the skill as a predictive gambling aid despite the manifest claiming that no选号思路 has an edge.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: Labeling ssq_auto as an 'authoritative prediction function' directly undermines the claimed 'no-edge/no-prediction' stance and signals to maintainers or integrators that predictive outputs are trusted and intended for use. That mismatch increases the risk that the skill will be deployed or presented as a legitimate forecasting tool, making misleading gambling guidance more credible.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The code section explicitly computes and prints '5组推荐' and maps front/back ball selections, which is recommendation generation in substance even if wrapped in disclaimers elsewhere. In a skill marketed as rational anti-scam education, this creates a misleading dual-use interface that can still function as a lottery-picking assistant and encourage gambling behavior.

Static analysis

No suspicious patterns detected.