Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its stated purpose of interpreting card spreads, saving readings locally, and creating documents, with minor privacy and reliability caveats.
Use this skill explicitly for card readings and expect questions and interpretations to remain saved locally until deleted. Generated HTML contacts external font providers. Prefer a regular user account with Chromium’s sandbox enabled, install dependencies using the bundled lockfile, and visually inspect outputs because validation can succeed after skipping browser checks.
Referenced artifact was not completely inspected
| `social-card` | `assets/seed-social-card.html` | `scripts/render-social-cards.js` | `lenormand-xhs-{topic}-{date}-NN.png` |
Referenced artifact was not completely inspected
node scripts/render-social-cards.js output/lenormand-xhs-{topic_slug}-{date}.html
Referenced artifact was not completely inspected
| `scripts/render-social-cards.js` | Puppeteer: social card HTML → 1080×1440 PNGs | Phase 3c |
Referenced artifact was not completely inspected
node scripts/validate.js output/lenormand-{spread_type}-{topic_slug}-{date}.html --type a4-pdf
Referenced artifact was not completely inspected
node scripts/validate.js output/lenormand-web-{topic_slug}-{date}.html --type web-page
Referenced artifact was not completely inspected
node scripts/validate.js output/lenormand-xhs-{topic_slug}-{date}.html --type social-card
Referenced artifact was not completely inspected
Validation is run automatically via `node scripts/validate.js` at the end of each product generation step. See Phase 3a–3c for usage. All checks must pass (exit
Referenced artifact was not completely inspected
node scripts/manage-readings.js record-product {reading_id} --type a4-pdf
Referenced artifact was not completely inspected
node scripts/manage-readings.js record-product {reading_id} --type web-page
Referenced artifact was not completely inspected
node scripts/manage-readings.js record-product {reading_id} --type social-card
Referenced artifact was not completely inspected
node scripts/manage-readings.js record-product {reading_id} --type long-image
Referenced artifact was not completely inspected
- "上次的解读" / "latest reading" → `node scripts/manage-readings.js latest`
Referenced artifact was not completely inspected
- "列出最近的解读" → `node scripts/manage-readings.js list --limit 5`
Referenced artifact was not completely inspected
| `scripts/manage-readings.js` | CLI: list, find, update reading index | Phase 2b, post-hoc regen |
Without declared permissions the skill's intent is opaque and cannot be validated.
Triggers such as "deciding between two options" can select this skill for ordinary decision-support requests without an explicit request for divination. If the host uses these triggers for automatic activation, the mandatory workflow can substitute an unwanted card-reading task and persist the user's question and interpretation locally without clear task-specific authorization; no external disclosure is shown.
The instruction requires all output to be Chinese or English based on the pasted prompt and explicitly rejects the user's profile and chat language. This imposes an output-language constraint without user opt-in, so a user requesting interpretation of a foreign-language spread cannot retain their preferred response language.
The exception handler calls finalize() without recording a failed check, so a browser launch, navigation, or evaluation failure can produce exit code 0 and 'All checks passed' when the completed static checks passed; missing Puppeteer has the same fail-open behavior. This can cause an agent or automated workflow to deliver incompletely validated artifacts, although this skill's skipped checks primarily concern typography and layout rather than security controls, limiting the demonstrated impact.
Mandatory external font imports cause network requests to jsDelivr when generated HTML is rendered with network access, exposing the renderer's IP address and request metadata without a disclosed privacy choice. This matters for potentially personal readings, although the imports do not themselves transmit reading contents, and offline or static outputs may not make such requests.
The topic_slug field must be a 2–6 character Chinese identifier, even though the schema supports English readings. This imposes a specific language on generated output without an explicit opt-in or a documented justification for the constraint.
The caret range permits newer Puppeteer 25.x releases, so installations without an enforced lockfile can introduce unreviewed dependency changes, including potentially compromised releases. Puppeteer is appropriate for this skill's PDF and image generation, but installation and browser automation make dependency integrity relevant. This is a low-severity supply-chain hardening issue, not evidence of malicious behavior or a known vulnerable version; an existing committed lockfile used with npm ci would substantially mitigate it.
"name": "in-the-cards-lenormand-scripts",
"private": true,
"dependencies": {
"puppeteer": "^25.1.0"
}
}
No suspicious patterns detected.