Huangxianshi Divination

黄仙师灵签抽签与解签。用户说“聊签/求签/抽一签/来一签/解签/全部解签”时使用。随机抽取1签并返回吉凶、签号、签题、签诗、典故全文；支持按方向解签或全部解签。

Security Scan

The skill appears to implement the claimed divination functionality, but there are inconsistencies and small risks (missing/ mismatched data filenames, inconsistent sign field names, and a shell script that fetches wttr.in and sleeps until sunrise) that warrant review before installing or running unattended.

Purpose & Capability

The files and code implement a local divination/interpretation tool matching the skill description. However there are minor mismatches: SKILL.md mentions data/signs_cache.json while the package ships with scripts/signs_data.py (the code prefers importing signs_data.py but falls back to signs_cache.json). Some functions use keys named 'number' while the provided SIGNS entries use 'no' which will cause runtime bugs (e.g., save_last_draw uses 'number' and may write null). The presence of a draw_at_sunrise.sh helper (not documented in SKILL.md) is logical for a 'draw-at-sunrise' feature but was not referenced in the instructions.

Instruction Scope

SKILL.md runtime instructions are largely limited to running the included Python CLI and formatting output (ok). But there are notable gaps: SKILL.md references a JSON cache file that is not present; the code will import signs_data.py instead. The code writes data/last_draw.json (persists the last draw) — SKILL.md did not mention persistence. The included draw_at_sunrise.sh script issues an external HTTP request to wttr.in to get sunrise time and sleeps until that time (long-running process). That script is not mentioned in SKILL.md and could be run by an operator or scheduled; it performs network access and can block for long periods. There are also inconsistent field names in the code vs data that can change runtime behavior and error handling.

Install Mechanism

Instruction-only + included scripts; no install spec, no remote downloads or package installs. This is low-risk from installation perspective (nothing is automatically written to disk by an installer).

Credentials

The skill requests no environment variables or credentials. The only external network call is the optional draw_at_sunrise.sh using wttr.in to obtain sunrise time, which is proportionate to the script's purpose but should be noted.

Persistence & Privilege

The skill writes a small file data/last_draw.json to persist the last drawn sign (normal for this use). It does not declare always:true and does not modify other skills or system config. The draw_at_sunrise.sh script may run as a long-lived job if started manually or scheduled; be cautious about running it unattended.

What to consider before installing

What to check before installing or running: - Functionality vs data: there are inconsistent key names ('no' vs 'number') between the SIGNS entries and some code paths (save_last_draw, find_sign_by_no). This will likely break 'explain' behavior or produce null values in last_draw.json — review and test the CLI locally. - Missing/mismatched files: SKILL.md mentions data/signs_cache.json but repository provides scripts/signs_data.py; the code handles both, but the mismatch indicates sloppy packaging. Verify the data source your agent will actually use. - draw_at_sunrise.sh: this shell script (not mentioned in SKILL.md) makes an HTTP request to wttr.in and sleeps until sunrise, then runs the draw. Only run/schedule it if you understand it will perform a network call and may block for long periods; run it in a controlled/sandboxed environment if you want the sunrise feature. - Data written: the skill will create/modify data/last_draw.json in the skill directory. If you are concerned about local filesystem writes, inspect and sandbox that directory (or adjust the code to use a safe path). - No credentials requested and no obfuscated code were found, but the code contains small logic bugs and undocumented behavior. If you plan to enable autonomous invocation or schedule the shell script, first run the CLI manually to validate outputs and fix the 'no'/'number' inconsistencies. If you are not comfortable reviewing/fixing the minor issues, run this skill in an isolated environment or decline to install.

黄仙师灵签（抽签 + 解签）

触发与流程

1. 用户说“聊签/求签/抽签/来一签”：

   • 执行 draw-ritual 抽签。
   • 仪式感文案分 三条独立消息 发送：
     1. 正在净手焚香
     2. 签筒摇动中
     3. 灵签已落，请接签
   • 然后立即发结果卡片（第4条消息，不要额外等待）。
   • 结尾提示：可直接“解签”，或指定方向（事业/财运/姻缘/健康/流年），或“全部解签”。

2. 用户说“解签”：

   • 若指定方向（事业/财运/姻缘/健康/流年/自身/家庭/迁居/名誉/友情/典故），只解该方向。
   • 若说“全部解签”，输出全部解释。
   • 若没指定签号，默认解“上一签”。

3. 若用户尚未抽签就直接说“解签”：

   • 自动先抽一签，再提示是否继续解签。

数据源

• 签数据已内置在 data/signs_cache.json 中

命令

python3 {baseDir}/scripts/lot_cli.py draw-ritual             # 默认：三段动画 + 结果卡
python3 {baseDir}/scripts/lot_cli.py draw-ritual --delay 0.15
python3 {baseDir}/scripts/lot_cli.py explain --no 12 --aspect career --format card
python3 {baseDir}/scripts/lot_cli.py explain --aspect all --format card   # 默认上一签

输出样式（跨端友好）

不要用复杂表格，优先用简洁卡片文本：

🔮 抽签中...（灵签翻动中）

━━━━━━━━━━
🎴 黄仙师灵签
⚖️ 吉凶：下下
🔢 签号：77
🏷️ 签题：左慈戏曹
📝 签诗：
画壁化羊戏奸雄
欺君罔上罪难容
仙家妙术虽玄妙
到底难逃劫数终
━━━━━━━━━━
可继续：解事业 / 解财运 / 解姻缘 / 全部解签

要求：

• 手机端优先（短段落、少换行但清晰）。
• 桌面端同样可读。
• 不输出玄学恐吓措辞，不给医疗/法律等高风险确定性建议。