Security audit

tarot-reading

Security checks for vulnerabilities and agentic risk

Overview

This is a local tarot-card drawing skill with broad trigger wording, but it does not show hidden data access, network activity, persistence, or destructive behavior.

Install only if you want ordinary advice, yes/no, reminder, or lost-item questions to potentially be handled as tarot readings. Treat outputs as entertainment, not factual guidance, and be aware that English readings may still include Chinese card meanings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill’s trigger description is overly broad and includes generic intents like advice, reminders, yes/no questions, and finding lost items, which can overlap with many normal conversations. This can cause the agent to invoke the tarot skill in situations where users did not explicitly request divination, leading to inappropriate responses, misrouting, or bypass of more suitable domain-specific skills and safety handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description declares very broad activation intents such as yes/no questions, finding lost items, and generic requests for advice or reminders. These overlap heavily with normal conversation, so an agent may invoke the tarot skill for unrelated user requests, causing unintended behavior and replacing grounded assistance with divination-style output.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases table uses common phrases like 'can I', 'will it', 'advice', 'guidance', 'where is', and 'be careful', which appear in many non-tarot requests. In a tool-selection system, this can misroute ordinary user queries into this skill, creating prompt-routing confusion and unreliable responses.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The question-mapping rules instruct the agent to classify generic linguistic forms like 'can/will/is', 'what to do', and 'where is/lost' directly into tarot categories. This materially increases accidental invocation risk because these patterns are ubiquitous in everyday requests, especially in assistants that rely on textual matching for skill routing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file contains user-facing natural-language card names and meanings primarily in Chinese, which can effectively force a specific language/locale if surfaced by the skill. The file does not indicate that the user can choose a language or that the Chinese-only presentation is intentionally limited to a justified region-specific use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This Python file contains user-facing natural-language strings exclusively in Chinese, including spread names, descriptions, and position labels. Under the policy rule for language or locale constraints, this can be a violation when a skill effectively forces a specific language without documenting user opt-in or a justified region-specific scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code automatically sets lang = 'en' whenever question_type matches an English keyword, overriding any user-provided language argument. This is a natural-language locale policy concern because it forces a language choice based on input form rather than preserving or confirming the user's selected locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.