六爻预测

Security checks across malware telemetry and agentic risk

Overview

This looks like a disclosed Liuyao divination helper, with practical cautions around overreliance, broad triggers, optional OpenAI use, and saved history.

Install only if you want an agent to provide traditional divination-style readings. Do not treat results as medical, legal, financial, or other professional advice; avoid enabling LLM mode for sensitive questions unless you accept external API processing; and periodically review or delete the saved history file if the questions are private.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: 该 README 将六爻占卜描述为“专业”工具，并展示完整流程与吉凶判断，但未明确声明结果仅供娱乐、文化研究或参考使用。这会增加用户将输出用于财务、健康、法律或人生重大决策的风险，尤其在 AI Agent 集成场景下更容易被误当作可靠建议。

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill advertises trigger phrases including very broad terms such as “起卦” and “排盘,” which can overlap with ordinary conversation or unrelated requests about divination concepts. Over-broad activation increases the chance the skill runs unexpectedly, causing unintended tool execution or user confusion even though the skill itself is not handling especially sensitive capabilities.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases “起卦” and “排盘” are generic terms that can appear in broader conversations beyond explicit invocation of this divination skill, increasing the chance of unintended activation. In an agent environment, overly broad triggers can cause the wrong skill to intercept user requests, leading to misrouting, confusing outputs, or inappropriate processing of unrelated content.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal