Security audit

Liuyao Bagua

Security checks for vulnerabilities and agentic risk

Overview

This is a local Chinese fortune-telling skill that runs a bundled Python script and does not show hidden data access, persistence, network use, or destructive behavior.

Install this only if you want Chinese-language entertainment fortune-telling from birth dates. Treat the output as entertainment, and be aware the activation wording may be broader than ideal for general career or finance questions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description and trigger conditions are broad enough that ordinary conversation about fate, fortune, or birth dates could activate the skill unexpectedly. This can cause the agent to invoke an unrelated fortune-telling workflow in contexts where the user did not clearly request it, increasing the chance of inappropriate tool use and confusing or misleading responses.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: Including generic phrases like ‘询问命运、运势、事业、财运’ without contextual constraints makes the trigger overly permissive. An agent may activate this skill for common life-advice questions, causing unintended execution of the script and presenting divination output where practical guidance was expected.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The file’s user-facing description and command output are Chinese-only, which effectively forces a specific language on users. Under the policy, locale or language constraints should either be optional, user-selectable, or clearly justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: L03 的整段技能描述仅以中文定义触发方式和使用行为，且未说明是否支持其他语言或由用户自行选择输出语言。按规则，若技能隐含强制特定语言而无用户选择或明确合理性说明，可构成语言/locale 策略问题。

Static analysis

No suspicious patterns detected.