Security audit
Security checks for vulnerabilities and agentic risk
This is a local birthday-based astrology skill with disclosed behavior and no evidence of hidden access, persistence, or data exfiltration.
Before installing, be aware that it runs local Node.js code and installs an npm dependency. It asks for a birth date and produces entertainment-oriented astrology output; do not treat its fortune, health, career, or relationship statements as professional advice.
Lines L091-L092 explain that 60 unique birthday signatures map to six planetary archetypes, but lines L095-L100 redefine the stars as simple contiguous numeric ranges '(1-10)', '(11-20)', etc. This is an internal documentation contradiction about how classification works, creating intent/code-description divergence within the skill documentation.
The manifest description explicitly defines the skill as a Japanese divination system, using Chinese and Japanese text, but provides no indication that users can choose language or locale. Under the policy rule for natural-language violations, locale constraints should be documented as optional or justified; this manifest does not make that explicit.
The dependency uses a caret range (^1.7.8), which permits automatic installation of newer compatible versions. If the upstream package is compromised or a malicious/broken release is published, installs may pull in unexpected code, creating a supply-chain risk; this is somewhat more relevant because the skill processes user-provided input and executes JavaScript at runtime.
"start": "node scripts/rokusei.js"
},
"dependencies": {
"lunar-typescript": "^1.7.8"
},
"keywords": ["rokusei", "六星占術", "占卜", "astrology", "japanese"],
"author": "ikplpeter",
This code contains a natural-language comment stating the skill supports only zh, en, and ja. Under the locale-policy rule, forcing a fixed language set without explicit user opt-in can be a policy concern unless the restriction is clearly justified as region-specific or the user is offered a choice.
No suspicious patterns detected.