Than Cuu Numerology Analysis

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:02 PM UTC
• Version: 1.0.0

Overview

The skill is a Vietnamese numerology/personality tool, but it automatically saves identifiable personal profiles and relationship analyses without clear opt-in, deletion, or privacy controls.

Review this carefully before installing. Do not provide ID numbers or document images, only the minimum name and birth-date fields if you choose to use it. Use it for another person only with their permission, and disable or edit the automatic knowledge-file storage unless you intentionally want identifiable personality reports saved and indexed on disk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13
• Finding: Automatic Plaintext Persistence and Indexing of Personal Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-14 and 28-32 **Vulnerability Type**: Unprotected persistent storage of personal and inferred data **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - **Họ tên đầy đủ** (theo CCCD/CMND) - **Ngày tháng năm sinh** (theo CCCD/CMND) ``` ```markdown ## Lưu trữ kết quả phân tích Sau khi thực hiện phân tích Thần Cửu (cho một người hoặc mối tương quan giữa hai người), em sẽ tự động lưu trữ toàn bộ nội dung kết quả vào thư mục `knowledge/md/ThanCuu/TuongQuan/` dưới dạng file `.md`. Tên file sẽ được đặt theo cú pháp `TenNguoi1_TenNguoi2_TuongQuan.md` (đối với phân tích tương quan) hoặc `TenNguoi_PhanTich.md` (đối với phân tích một người). Đồng thời, em sẽ cập nhật `knowledge/INDEX.md` để file kết quả này được đưa vào kho tri thức của anh. Khi anh muốn xem lại, em sẽ truy xuất từ đó để cung cấp nhanh chóng, không cần tính toán lại. ``` Related data-collection requirements also appear in `references/GioiThieuThanCuu.md`, lines 80-83, and `references/TracNghiemThanCuu.md`, lines 7-15. ### Technical Analysis The Skill requests full legal names and dates of birth based on official identity documents. It then instructs the Agent to store the complete analysis automatically in plaintext Markdown and add the record to a persistent knowledge index. No explicit consent check, storage opt-out, retention period, deletion mechanism, redaction policy, access restriction, or encryption requirement is defined. Relationship analysis can also persist information about a second person who may not have consented to collection or storage. Indexing increases discoverability and extends exposure beyond the immediate session. The generated reports additionally contain inferred personality and relationship information associated with identifiable individuals. ### Attack Path 1. A user invokes the Skill and supplies one or two full legal names and dates of birth. 2. The Agent generates identifiable ...[truncated 891 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make persistent storage explicitly opt-in rather than automatic. 2. Obtain informed consent from every person represented in a report, especially for two-person analyses. 3. Default to transient processing and return the result directly without writing it to disk. 4. Store only the minimum data necessary; avoid retaining dates of birth and full legal names when a pseudonymous identifier is sufficient. 5. Do not add sensitive reports to a global knowledge index by default. 6. Define a clear retention period and provide deletion, review, and export controls. 7. Restrict file permissions to the minimum required principals. 8. Encrypt sensitive records at rest where supported. 9. Warn users before persistence and clearly identify the destination, retained fields, retention duration, and access scope. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30
• Finding: Unsanitized Personal Names Used in Persistent Output Filenames<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 30 **Vulnerability Type**: Path traversal and unsafe file overwrite risk **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Sau khi thực hiện phân tích Thần Cửu (cho một người hoặc mối tương quan giữa hai người), em sẽ tự động lưu trữ toàn bộ nội dung kết quả vào thư mục `knowledge/md/ThanCuu/TuongQuan/` dưới dạng file `.md`. Tên file sẽ được đặt theo cú pháp `TenNguoi1_TenNguoi2_TuongQuan.md` (đối với phân tích tương quan) hoặc `TenNguoi_PhanTich.md` (đối với phân tích một người). ``` ### Technical Analysis The Skill instructs the Agent to construct persistent filenames from user-supplied names but does not require sanitization, canonicalization, path-separator removal, resolved-path containment checks, length limits, or collision handling. If an implementing Agent directly interpolates the supplied value into a filesystem path, traversal components or path separators could cause the resolved destination to escape the intended directory. Even without traversal, two identical or normalization-equivalent names could produce the same filename and overwrite an existing report. Exploitability depends on the behavior of the Agent's file-writing tool. A tool that independently rejects traversal and prevents overwrite would reduce the risk, but the Skill itself defines no such safeguard. ### Attack Path 1. An attacker supplies a crafted value as a person's name, including path separators, traversal components, or a name designed to collide with an existing report. 2. The Agent interpolates the value into `TenNguoi_PhanTich.md` or `TenNguoi1_TenNguoi2_TuongQuan.md`. 3. The Agent joins the resulting filename to `knowledge/md/ThanCuu/TuongQuan/` without canonicalization and containment validation. 4. Automatic persistence writes the generated report outside the intended directory or overwrites an existing file. 5. The subsequent index update may expose the unintended path or persis ...[truncated 630 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never use raw user input as a path or filename. 2. Normalize names for display separately from storage identifiers. 3. Generate storage filenames using random UUIDs or cryptographically random identifiers. 4. If readable slugs are required, enforce a strict allowlist such as ASCII letters, digits, underscores, and hyphens. 5. Remove or reject `/`, `\`, `..`, control characters, null bytes, reserved device names, and Unicode separator lookalikes. 6. Apply a conservative filename-length limit. 7. Resolve the final path and verify that it remains under the intended storage directory before writing. 8. Use exclusive file creation or a collision-safe random suffix to prevent unintended overwrites. 9. Keep the display name inside the report content rather than embedding the legal name in the filesystem path. 10. Ensure the knowledge index records only validated, repository-relative paths. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata claims a numerology analysis based on full name and date of birth, but the file is actually a long personality questionnaire resembling a psychometric/MBTI-style test. This mismatch is dangerous because it can mislead users about what data is being collected and how outputs are derived, undermining informed consent and enabling deceptive profiling.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill requests highly sensitive personal data, including full legal names and dates of birth, and then states that it will automatically persist the full analysis results into a knowledge repository. This creates a real privacy and data-protection risk because users are not clearly warned about retention, consent, access scope, or deletion, and the stored filenames themselves may expose identities.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs users to use identity document data such as national ID card information as the authoritative source for analysis, but provides no privacy minimization, storage, masking, or handling guidance. This creates a real privacy risk because an agent implementing the skill may prompt for or process highly sensitive personal data unnecessarily, increasing exposure of regulated identity information.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document encourages relationship and personality analysis between two people without any requirement that the second person's data be provided with consent or that privacy implications be considered. In skill context, this increases the risk of profiling or inferring sensitive traits about another person from their name and birth date without their knowledge.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains user-facing natural-language content exclusively in Vietnamese, with no indication that language selection is optional or configurable. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file contains user-facing natural-language content exclusively in Vietnamese across the whole document. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file contains only Vietnamese natural-language content and does not indicate that language selection is optional or limited to a justified regional context. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains end-user instructional/descriptive content entirely in Vietnamese and does not provide any opt-in, alternative language, or justification for being locale-specific. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire skill content is written in Vietnamese and provides no indication that users may choose another language or locale. Under the policy rules, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This file contains user-facing natural language exclusively in Vietnamese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the language/locale policy, forcing a specific language without user choice or justification is a policy concern.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The document asks users to provide information 'theo CCCD hoặc CMTND' and includes fields beyond the stated skill need, while the manifest says only name and birth date are relevant. Requesting official-ID-aligned details without necessity increases privacy risk and can normalize overcollection of sensitive personal data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file solicits government-ID-style personal information but provides no privacy notice, retention policy, purpose limitation, or handling guidance. This is dangerous because users may disclose identifying data without understanding storage, sharing, or misuse risks, creating exposure to privacy violations and identity-related abuse.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This file presents all user-facing instructional content exclusively in Vietnamese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified, which is not stated here.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The description and instructions are written specifically for 'anh Vũ' and consistently assume that user identity and preferred address form, rather than offering a neutral or user-selected mode. This can be a natural-language policy issue when a skill hard-codes a specific user-facing language/register without opt-in.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The entire skill content is written in Vietnamese and provides no indication that other languages are supported or that Vietnamese is an intentional user-selected locale. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: All user-facing instructions and questionnaire content are presented exclusively in Vietnamese, with no indication that the language choice is optional or contextually required. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.