Yunshi

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:11 AM UTC
• Version: 1.2.0

Overview

This astrology skill is coherent overall, but it needs Review because its profile and push scripts allow overbroad local file access and persistent scheduled agent prompts built from user profile data.

Install only if you are comfortable with local storage of names, birth details, family data, preference history, and scheduled fortune messages. Review or fix the userId path handling and scheduled-prompt construction before enabling push features in a shared or multi-user environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/profile.js:20

Finding

Path Traversal Enables Arbitrary JSON File Access and Deletion

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/push-toggle.js:122

Finding

Persistent Prompt Injection Through Untrusted Profile Fields

Content

View full analysis

${top2} > ${top3} 步骤： 1) 运行 node scripts/daily-fortune.js 获取今日干支基础运程 2) 搜索今日重要新闻（财经、政策、社会、国际各一条） ${NEWS_FORTUNE_MAPPING} 3) 结合八字与新闻做个性化分析， ...[truncated 4053 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (77)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local file creation of user profiles, command-line registration, and push enablement are meaningful data-handling operations not reflected in the high-level description. Even if benignly intended, undisclosed collection and persistence of birth and identity data increase privacy risk and may bypass user expectations about ephemeral assistant interactions.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

node scripts/profile.js show <userId>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

node scripts/profile.js show <userId>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

node scripts/ziwei.js <出生日期> <性别> [时辰]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

node scripts/qimen.js [日期] [时辰]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

node scripts/zhuanshi.js <YYYY-MM> <活动类型> [用户八字]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

node scripts/fengshui.js [八字] [年份]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

node scripts/marriage.js <userId1> <userId2>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

node scripts/liuyao.js [010203] [问题]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

node scripts/push-toggle.js on|off|status <userId>

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/ziwei.js (reported line 43)May include surrounding context.

js

if (rule) rules.push(rule);
  }

  return rules;
}

/**

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/ziwei.js (reported line 877)May include surrounding context.

js

const dayStem = key[0];
    const mz = key.slice(1);
    if (mz === branch) {
      return rule['主用神'][0];
    }
  }
  return null;

Static analysis

No suspicious patterns detected.