中国农历查询

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:46 AM UTC
• Version: 1.0.0

Overview

The skill is a narrow Chinese lunar-calendar helper, but it asks the agent to install and run an unpinned npm package from shared temporary storage.

Review this before installing if your agent runs with access to sensitive files, credentials, or network permissions. Prefer a version-pinned, integrity-checked dependency installed in a private project directory, or a reviewed local implementation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Runtime npm Dependency Installed and Loaded from Shared Temporary Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-16; dependency loading also occurs at lines 22-23 and 57-59
Vulnerability Type: Unpinned third-party dependency and unsafe shared temporary installation path
Risk Level: Medium

Vulnerable Code

bash

cd /tmp && npm install chinese-lunar-calendar

javascript

const { getLunar } = require('/tmp/node_modules/chinese-lunar-calendar/src/lunar_calendar.js');

Technical Analysis

The skill directs the agent to install chinese-lunar-calendar without an exact version, lockfile, or integrity constraint. Consequently, the package content resolved at execution time may differ from the content that was originally reviewed.

npm package installation can execute package lifecycle scripts, while importing a Node.js module executes its initialization code. A compromised package release or registry response could therefore cause arbitrary JavaScript to run under the account invoking the skill.

The package is installed into /tmp/node_modules, a shared and predictable temporary location. Another local process with sufficient filesystem access could pre-create, replace, or modify package files before they are loaded. The skill also imports an internal source path rather than a documented package entry point, increasing coupling to unreviewed implementation details.

Attack Path

1. An attacker compromises a future release of chinese-lunar-calendar, influences package resolution, or gains sufficient local access to modify /tmp/node_modules/chinese-lunar-calendar.
2. The agent runs the documented unpinned npm install command or uses an existing package tree under /tmp.
3. Malicious code executes through an npm lifecycle script during installation or through module initialization when require() loads the altered file.
4. The code operates with the filesystem, network, environment-variable, and process privileges of the user runni ...[truncated 630 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version rather than resolving the latest available release.
2. Commit and verify a lockfile with npm integrity hashes, then install using npm ci.
3. Install dependencies inside a dedicated, permission-restricted project directory instead of the shared /tmp/node_modules path.
4. Review package lifecycle scripts and, where compatible with the package, use npm ci --ignore-scripts to prevent installation-time code execution.
5. Import the package through its documented public entry point rather than directly loading a file under src/.
6. Run the conversion process under a least-privileged account with restricted filesystem, credential, and network access.
7. Consider replacing the runtime installation with a vendored and reviewed implementation or a prebuilt, integrity-verified dependency artifact.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description, headings, and sample user prompts are entirely in Chinese and present the skill as operating only in Chinese. Under the policy rule, a skill should not force a specific language or locale unless it offers user opt-in or clearly documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.