Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Zi Wei astrology charting skill with explicit local calculation and optional Wiki lookup behavior, but users should be mindful of birth-data privacy if using the external Wiki workflow.
Install only if you are comfortable providing birth datetime, timezone, gender, and optional location data to a local charting script. Treat the Wiki lookup as external network use and send only minimal derived terms, not full birth profiles, unless you intentionally want that data included.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.idea/
.vscode/
*.log
.env
.env.*
!*.env.example
The declared purpose and the detected behavior diverge significantly: the skill appears to perform broader computations, profile/file I/O, and undeclared astrology-related processing while not implementing parts of the promised interpretation workflow. This mismatch is dangerous because reviewers and policy engines may approve or expose the skill under a narrower trust model than its actual capabilities, increasing the chance of unintended data handling, overcollection, or misuse of file and processing features.
Without declared permissions the skill's intent is opaque and cannot be validated.
This code emits user-facing CLI descriptions, errors, and chart output entirely in Chinese, including fixed strings in the parser help text and printed results. The skill does not provide any language or locale opt-in mechanism, which is a natural-language policy concern when a skill mandates a specific language for all users.
La ligne indique qu’en l’absence de locale Wiki, la valeur par défaut est en avec un repli éventuel zh-Hans. Cela constitue une contrainte de langue/locale imposée sans mention d’un choix explicite de l’utilisateur, ce qui correspond à une violation de politique en langage naturel.
The README states that the Wiki API is optional and involves network access, but it does not clearly warn users that birth-chart-related terms or other request data may be sent to an external service. For markdown files, network behaviors that may affect privacy should be disclosed with a user-facing warning.
The workflow includes direct external HTTP requests to a third-party Wiki API but does not explicitly warn that user prompts, chart facts, or derived birth-profile information could be transmitted off-host. In the context of an astrology skill handling sensitive personal birth data, even optional network lookups can create privacy risk if operators assume the workflow is fully local.
The README explicitly documents optional network calls to an external Wiki API but does not warn that user-supplied birth/profile context or derived chart terms could be transmitted off-host. In a divination/astrology skill, birth data is sensitive personal information, so missing privacy disclosure and data-minimization guidance can lead to unintended exposure even if the API call is only for interpretation lookup.
The examples for both search and page retrieval explicitly use locale=en, which suggests the skill defaults to English content without presenting a user choice. This can violate language/locale policy when a skill constrains output or retrieved content to a specific locale absent documented opt-in or justification.
No suspicious patterns detected.