Security audit

Suanming

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local fortune-telling skill that asks for birth details and returns entertainment-style analysis, with no evidence of hidden access, persistence, or data exfiltration.

Install only if you are comfortable sharing birth details in the chat for entertainment purposes. Treat the output as non-authoritative; the skill appears simplified and template-based rather than a real liuyao or Bazi charting implementation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 该代码的总体领域仍是算命/命理分析，和声明的大方向相关，但存在实质性描述不符。声明明确提到‘六爻八卦算命术’、‘根据出生年月日时’、‘运用六爻排盘系统’，这通常意味着会进行较完整的六爻起卦/排盘或至少较贴近该术数的方法。然而实际代码只是：1）按年份推一个简化干支；2）通过年月日数字和及奇偶性在8个八卦中取索引；3）再按时辰或日期取一个副卦；4）套用固定五行文案输出分析。没有六爻爻位、动爻、变卦、世应、纳甲等六爻核心机制，也没有真正的生辰八字排盘分析。因此其主功能虽是娱乐性命理生成，但与宣称的具体方法和准确表述存在明显偏差，属于描述与行为不匹配。

Vague Triggers

Medium

Confidence: 96% confidence
Finding: Overly broad trigger keywords can cause the skill to activate in unrelated conversations, increasing the chance that it solicits sensitive birth data unexpectedly or displaces more appropriate handling. In this context, misfires are more concerning because the skill requests personal information and provides pseudo-authoritative guidance.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs collection of full birth date and time, which is sensitive personal data, without any privacy notice, minimization guidance, or explanation of handling risks. Even if used for entertainment, prompting for such data can expose users to unnecessary privacy harm, especially when combined with accidental triggering.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The script’s natural-language interface, usage text, and generated analysis are entirely in Chinese, including all user-facing strings. Because it does not provide any user opt-in or alternative locale selection, it constitutes a language/locale policy violation under the stated rule.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest says the skill uses '六爻排盘系统' and is suitable for users providing 生辰八字 for analysis. However, the code only derives a main and sub trigram from simple arithmetic on year/month/day/hour and a simplified Ganzhi year, without implementing a real 六爻 casting or Bazi charting process. This is a semantic mismatch between the advertised divination method and the actual computation performed.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: SQP-3 适用于所有文件类型。文档要求“语气温和亲切，带有神秘感”，且全文仅以中文定义交互方式，但未说明这是可选风格或可根据用户语言偏好切换，存在默认强制特定语言/表达风格的倾向。

Intent-Code Divergence

Low

Confidence: 75% confidence
Finding: The documentation states '根据出生年月日计算命理', implying substantive date-based destiny calculation. In practice, downstream analysis functions generate canned personality, career, wealth, love, and health text almost entirely from the selected trigram's element, with limited dependence on the provided birth data. This documentation overstates what the implementation actually analyzes.

Static analysis

No suspicious patterns detected.