Security audit

善起名 · 国学命名助手

Security checks for vulnerabilities and agentic risk

Overview

This naming-analysis skill is coherent and does not show hidden data transfer, persistence, or destructive behavior, though it asks for sensitive family birth information.

Install only if you are comfortable sharing names and birth dates for this cultural naming workflow. You can limit what you provide, skip parent details, or avoid exact birth times if you do not want a full family bazi comparison.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill metadata lists broad trigger phrases such as “八字” and “起名,” which are common conversational terms and can cause the skill to activate in contexts where the user did not intend to invoke this specialized workflow. Unintended activation is risky here because the skill then prompts for highly sensitive personal data, increasing the chance of unnecessary collection and privacy exposure.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow explicitly instructs collection of names, birth dates, and potentially birth times for a child and both parents, which is highly sensitive personal data and, for the child, especially privacy-sensitive. Although the file later says data is only used for the current analysis, it does not require an upfront warning, data minimization, or explicit consent before collecting family-wide identifiers, creating avoidable privacy and profiling risk.

Static analysis

No suspicious patterns detected.