Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Liu Yao casting helper that runs a small local Node script and optionally fetches disclosed Wiki reference pages.
Install only if you are comfortable with an agent using Node locally and fetching Mystilink Wiki reference pages. Avoid putting sensitive personal details into remote Wiki searches; use fixed page lookups or local references when privacy matters.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.idea/
.vscode/
*.log
.env
.env.*
!*.env.example
The README explicitly says that classics often fall back to zh-Hans when other locales lack text, which forces a specific language variant when the requested locale is unavailable. This is a natural-language locale policy concern because the user is not described as being asked to opt in to that fallback or offered a choice.
The documentation instructs the skill to fetch interpretation pages from a live external Wiki but does not disclose that user-supplied divination topics, locale choices, or other contextual data may be transmitted to a third-party service during use. In an agent-skill context, this creates a real privacy and data-governance risk because sensitive personal questions are likely inputs for this skill, and users may not expect external network access.
The README states that classical text commonly falls back to zh-Hans when the requested locale lacks body content, and that omitted wiki locale defaults to en. This imposes language/locale behavior automatically rather than offering the user a choice, which can violate locale preference policy.
The markdown shows API usage with locale=en on both listed endpoints, which instructs agents toward English-only behavior. This is a natural-language locale policy concern because the file does not offer an opt-in choice or explain why English is required.
The README explicitly recommends network access to external Wiki resources for interpretation, but it does not warn that user questions, cast details, or contextual matter may be transmitted to a third-party service. In this skill's context, users may submit sensitive personal or decision-related topics, so silent external lookups create a real privacy and data disclosure risk even if there is no obvious code execution issue.
The file explicitly says Locale Wiki omitida → en, which establishes English as the default locale when none is specified. Under the language/locale policy, forcing a specific language without offering a user choice or opt-in is a natural-language policy concern.
This markdown file describes a workflow that fetches content from external wiki endpoints, which is a behavior that can affect privacy and network usage. The description shows the GET requests but does not include any user-facing warning that the skill may contact external services or that user query context could be transmitted when retrieving interpretations.
No suspicious patterns detected.