Aistro

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:59 AM UTC
• Version: 0.1.3

Overview

This astrology skill is purpose-aligned and does not show hidden persistence, exfiltration, or destructive behavior, though users should be aware it asks for birth details and installs npm dependencies for calculations.

Before installing, be comfortable sharing birth date, birth time, and birth place in chat context, and avoid entering another person's birth details unless you have permission. The skill may run npm install for its local calculation scripts, so review dependencies if you require strict reproducibility.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to collect and store sensitive personal data in conversation context, including full birth date, birth time, and birth place, without any user-facing notice about retention, downstream use, or minimization. Even though this is not classic exploit code, it creates a real privacy risk because the data can persist in logs/context and can be combined to identify or profile users.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

## Calculation Scripts

This skill includes scripts in `scripts/` for precise astronomical calculations. **Always use these scripts instead of estimating.**

**IMPORTANT — Dependency check:** Before running any script, ensure dependencies are installed. Run this once at the start of each session:
```bash

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The embedded prompt patterns explicitly require output in Chinese and the document presents Chinese display names as part of the required report behavior. There is no indication that the user can choose their preferred language or that the skill is limited to a Chinese-only context, which creates a locale-policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill hard-codes a Chinese-language prompt pattern for the report title without checking or honoring the user's language preference. This can override user intent, reduce transparency, and cause the model to generate output in an unexpected language, which is especially problematic for consent, accessibility, and downstream integrations expecting locale-aware behavior.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The per-planet summary prompt embeds Chinese-language instructions and a fixed stylistic framing, which can force responses into a language the user did not request. While not a code-execution issue, it is a genuine prompt-quality and user-control weakness because the skill may ignore user language preferences and produce misleadingly rigid output behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The detailed report section prescribes Chinese-only phrasing and tone across all three subsections, creating a systematic language lock-in for expanded output. In this skill context, the issue is less dangerous than command injection or data exfiltration, but it still undermines user autonomy, accessibility, and reliable multilingual operation across the product.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill hard-codes Chinese phrasing and output constraints in the title instructions without any user language preference check. This can override the user's requested language or accessibility needs, causing unexpected or exclusionary behavior, but it does not directly create a security compromise.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The summary section mandates Chinese wording conventions and a specific locale/style pattern without opt-in. This is risky from a policy and UX standpoint because it can coerce responses into an unintended language or format, though the impact is limited to misalignment rather than data exposure or code execution.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The per-topic prompts repeatedly enforce Chinese output conventions and phrasing restrictions across all detailed report sections without offering a language choice. In context, this is a genuine instruction-quality vulnerability because it can systematically override user intent and reduce accessibility, but it is not made more dangerous by the astrology domain and has no direct security exploit path.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly requests and outputs a second person's birth date, time, and place, which are sensitive personal data points, yet it provides no privacy notice, consent check, or data-minimization guidance. In a synastry context this is not inherently malicious, but it creates a real privacy risk because users may submit identifiable third-party data without that person's knowledge or permission.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: Several prompt patterns are written as mandatory Chinese instructions, and the workflow specifically tells the user to select "全部" for the full report. This imposes a language/locale choice without opt-in or an explicit justification, which is a natural-language policy violation under the locale rule.

Description-Behavior Mismatch

Low

• Confidence: 95% confidence
• Finding: The manifest description explicitly says the skill supports five modes: Chat, Natal Report, Predict Report, Synastry Report, and Moon Phase Report. The file later defines and routes requests to an additional Guide mode for astrology concept explanations, which is a behavior/documentation mismatch relative to the manifest's stated mode list.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"description": "Astrology calculation scripts for the Aistro skill",
  "dependencies": {
    "circular-natal-horoscope-js": "1.1.0",
    "dayjs": "^1.11.0"
  }
}

• Confidence: 94% confidence
• Finding: The dependency version for dayjs is specified with a caret range (^1.11.0), which allows newer compatible releases to be installed over time. This weakens build reproducibility and can unintentionally introduce a compromised or breaking upstream package version through the software supply chain.

Static analysis

No suspicious patterns detected.