Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Chinese-language I Ching/Liuyao divination skill that uses local reference files and packaged scripts without evidence of hidden, destructive, credential-seeking, or network behavior.
Install only if you want a Chinese-language Liuyao/I Ching divination helper and are comfortable with it running its bundled local Python script for hexagram generation. Be aware that broad divination-related keywords may activate it, and divination output should be treated as cultural or reflective guidance, not professional advice.
The skill is configured to auto-activate on a broad set of generic terms such as 'divination' and 'hexagram' without clear scope constraints or confirmation gating. In an AI assistant context, this can cause unintended invocation in unrelated conversations, increasing the chance the model follows the skill's specialized workflow when the user did not intend to use it.
The skill instructs the agent to read local reference files and invoke local scripts, but it does not declare any explicit tool or permission scope. That mismatch can cause the runtime to grant broader-than-necessary filesystem capabilities or leave operators unaware that the skill depends on code/file access, increasing the risk of unintended file reads or writes if the skill is modified or abused.
The skill content, workflow, output format, and FAQs are written entirely in Chinese and direct the agent to respond using Chinese divination terminology and source texts. There is no indication that users may choose another language or that the Chinese-only behavior is a justified locale constraint, which can violate language/locale policy requirements.
The natural-language instructions and usage guidance are written in Chinese throughout the README, but there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can amount to an implicit language constraint without user opt-in.
This manifest-style JSON stores user-facing names, directions, and labels entirely in Chinese characters across the dataset. Under the policy, locale-specific language constraints should either offer a choice or clearly document that the skill is region-specific; this file provides neither in the data itself.
The description string is written as a Chinese-language skill description and does not indicate any user-selectable language or locale behavior. For a general-purpose package manifest, this can violate the language/locale policy when it implies the skill is intended to operate in a fixed language without opt-in or documented regional scope.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
This markdown file presents all content exclusively in Chinese and does not indicate that the language is optional, user-selectable, or justified by a region-specific purpose. Under the language/locale policy check, a skill file that forces a single language without opt-in can be considered a natural-language policy issue.
This markdown file presents the skill/reference content exclusively in Chinese and does not state that the user opted into Chinese or that the material is intentionally limited to a Chinese-language audience. Under the policy rule for language/locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.
This code file contains natural-language expectations that require output such as "乾为天", "动爻", and "静卦", indicating the skill behavior is fixed to Chinese text. Under the policy, forcing a specific language without offering user choice can be a locale/language policy violation.
Detected: suspicious.dynamic_code_execution
