Star Sign / Horoscope Inquiry - 星座运势查询

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:57 AM UTC
• Version: 1.0.4

Overview

This is a straightforward horoscope lookup skill that uses a Jisu API key and sends limited horoscope query data to JisuAPI.

Install only if you are comfortable giving the skill a JisuAPI AppKey and allowing outbound requests to JisuAPI for horoscope data. Avoid auto-loading returned plain-HTTP icon URLs unless your client proxies or upgrades them safely.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares use of environment variables and, by design, makes outbound API requests, but it does not explicitly declare a tool/permission scope such as allowed network access or env usage. This weakens least-privilege controls and makes it harder for a host agent to enforce or review what capabilities the skill should have.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description is written as an activation/instruction sentence entirely in Chinese and specifies user utterances only in Chinese, which implies the skill is intended to operate in a fixed language. The file does not offer user opt-in for language choice or explain that the skill is intentionally limited to a Chinese-speaking locale or audience.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill documentation includes external resource URLs over plain HTTP for icon images. If clients or downstream renderers fetch these URLs, content can be intercepted or modified in transit, enabling tracking, mixed-content issues, or malicious payload substitution depending on the consumer.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

"astroid": "1",
    "astroname": "白羊座",
    "date": "3-21~4-19",
    "pic": "http://api.jisuapi.com/astro/static/images/baiyang.png"
  },
  {
    "astroid": "2",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This finding is the same class of issue: a plain-HTTP external image URL is present in example output. Even though it appears in documentation, agents or UIs may treat such fields as fetchable resources, creating an avoidable insecure outbound request path.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

"astroid": "2", "astroname": "金牛座", "date": "4-20~5-20", "pic": "http://api.jisuapi.com/astro/static/images/jinniu.png" } ]

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · astro.py (reported line 14)May include surrounding context.

python

import requests


ASTRO_ALL_URL = "https://api.jisuapi.com/astro/all"
ASTRO_FORTUNE_URL = "https://api.jisuapi.com/astro/fortune"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · astro.py (reported line 15)May include surrounding context.

python

import requests


ASTRO_ALL_URL = "https://api.jisuapi.com/astro/all"
ASTRO_FORTUNE_URL = "https://api.jisuapi.com/astro/fortune"

Static analysis

No suspicious patterns detected.