bazi-engine（四柱八字命理引擎）

• Outcome: Review
• Latest audit: Aug 24, 2026 · 11:03 AM UTC
• Version: 1.3.6

Overview

This is a disclosed Bazi fortune-telling skill, but it needs review because it collects sensitive birth/profile data and includes some under-scoped high-impact guidance and UI safety issues.

Install only if you are comfortable sharing birth/profile details with your assistant environment. Treat all health, marriage, financial, and fortune outputs as cultural entertainment, not advice. Avoid entering real names or third-party data unless needed, and do not use any optional photo or external-site workflow without a clear privacy notice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The rule set implements health and养生-style inferences that can be presented as personalized health guidance from birth data, which materially exceeds a fortune-telling skill and can mislead users into treating non-medical output as health advice. Even though many entries include soft disclaimers, the rules still generate concrete symptom and organ-related statements, increasing the chance of harmful self-triage or delayed care.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The prompt materially broadens the skill from BaZi birth-data analysis into additional divination domains including Ziwei Doushu, physiognomy, and palmistry. This increases data collection and inference scope beyond the stated purpose, enabling unnecessary collection of images and expanded profiling without clear need or consent boundaries.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The template asks for face and hand photos for physiognomy and palm reading even though the skill is described primarily as BaZi analysis based on birth information. Face and hand photos are highly sensitive biometric-like data, and collecting them without strict necessity creates avoidable privacy and profiling risk.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The template directs use of third-party websites and software for calendrical conversion and chart generation, which can expose users' birth data and related personal details to external services outside the skill's stated boundary. This creates unnecessary data-sharing and supply-chain risk if those services are not vetted, disclosed, and minimized.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to provide highly sensitive personal data—full name, birth date, birth time, sex, and birthplace—without any accompanying privacy notice, retention policy, minimization guidance, or warning about how that data is handled. In the context of a skill distributed through third-party AI assistants and online services, this increases the risk of oversharing, unintended storage, profiling, or downstream misuse of personal data.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill is configured to auto-activate on very broad phrases like '算命' and '八字', even when the user did not explicitly invoke the skill. This can cause unintended collection of highly sensitive personal data such as birth date, time, sex, and location, and can hijack unrelated conversations where those words appear casually.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This content presents disaster, injury, illness, bereavement, and relationship-harm interpretations as actionable reference material without any visible caution that it is non-professional, non-medical, and non-deterministic. In the context of a fortune-telling skill that explicitly aims to guide users on life events and health/fortune, such statements can unduly influence vulnerable users’ decisions, increase distress, or discourage appropriate professional help.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This section gives health, lifespan, and disaster prognostications as authoritative content without any disclaimer that it is not medical, legal, or safety guidance. In the context of a fortune-telling skill that actively collects personal data and produces individualized analysis, users may act on alarming predictions or defer real medical or safety decisions, creating a meaningful risk of psychological harm and unsafe decision-making.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The document encodes rigid gender-specific rules, family roles, and value judgments as fixed defaults, such as assigning spouse and children roles by sex and describing women through normative marital standards. In a user-facing analysis skill, this can produce discriminatory or stigmatizing outputs, especially for users who are non-binary, LGBTQ+, or simply do not accept these traditional role assumptions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This knowledge-base file explicitly supports AI fortune-telling and life-outcome analysis, including marriage, luck, and other personally consequential topics, but it does not include any disclaimer that results are non-factual, non-diagnostic, and not suitable for important decisions. In the context of an agent skill that collects personal birth data and produces authoritative-sounding outputs with cited classics, users may over-trust the system and use it for sensitive choices involving relationships, finances, or wellbeing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section teaches users to infer health conditions, disease risk, and lifespan from birth data using occult claims, yet it does not place a clear, proximate disclaimer that the content is not medical or mental-health advice. In the context of an interactive fortune-telling skill that collects personal data and generates individualized conclusions, users may delay proper care, internalize harmful predictions, or treat fabricated health assessments as authoritative.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The content provides heuristics for judging marriage quality, infidelity, divorce risk, and third-party involvement without a warning about privacy, consent, uncertainty, or interpersonal harm. In a personalized divination skill, such outputs can provoke coercion, surveillance, conflict escalation, or reputational harm based on unfounded inferences about real partners and family members.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The description and usage note define broad matching behavior and do not clearly constrain when the large rule corpus should be invoked, creating a risk of over-triggering highly personalized inference content outside user intent. In a skill that derives sensitive conclusions from birth data, weak invocation boundaries can cause privacy-invasive or manipulative output in contexts where the user did not explicitly request such analysis.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill requests a full set of sensitive personal attributes—name, date of birth, birth time, sex, birthplace—and optionally face and hand photos, but does not pair that collection with an adequate upfront warning about sensitivity, retention, sharing, or safer alternatives. In this context, the data can support extensive personal profiling well beyond a lightweight horoscope interaction.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The README is entirely in Chinese and frames activation around Chinese-language trigger terms without indicating language choice or consent. In a user-facing agent, this can cause users to receive high-stakes personal guidance in a language they may not fully understand, undermining informed consent and increasing the risk of misunderstanding sensitive fortune-telling outputs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports marriage compatibility, life guidance, fortune, and remedial advice, yet the README only includes a brief disclaimer that analysis is for reference and not decision-making. Given the highly personal nature of these outputs, the lack of prominent user warnings and guardrails can lead users to over-rely on advice affecting relationships, finances, health, or other important decisions.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The activation scope is explicitly broad: it triggers not only on direct requests to use the skill, but also on generic mentions like “算命/八字/fortune.” That can cause unintended invocation during ordinary conversation, pulling users into a specialized workflow that collects sensitive personal data such as birth date, time, gender, and birthplace. In context, this is more dangerous because the skill is designed to gather highly identifying profile data once activated.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script reads JavaScript embedded in ../ui/index.html, extracts a <script> block with a regex, and executes it via eval. If that HTML file is modified by a contributor, compromised dependency, or build artifact, arbitrary code will run with Node.js privileges during local use or CI, which can lead to command execution, file access, or secret exposure. In this skill context, the danger is somewhat elevated because this repository appears to process domain logic from UI code, making such tooling likely to be run by developers or automation with broad filesystem access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script extracts JavaScript from an HTML file and executes it via eval, which turns the HTML/embedded script into code execution in the Node.js process. If index.html or its script block is modified by a compromised dependency, malicious commit, or unexpected build artifact, this tool will execute arbitrary code with local filesystem/process privileges. In this skill context, the danger is somewhat increased because the code runs as a developer/CI utility, where execution often has broader repo and environment access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file reads JavaScript out of an HTML file and executes it with eval, which means any code present in ui/index.html will run with the full privileges of the Node.js process. In a repository or supply-chain scenario, a modified HTML script could access the filesystem, environment variables, or spawn processes during testing, making this a real code-execution risk even though the apparent purpose is test harnessing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The test harness extracts JavaScript from an HTML file and executes it with eval, which makes any script content in ui/index.html run with Node.js privileges during testing. If that HTML or its generation pipeline is modified by an attacker or untrusted contributor, this can lead to arbitrary code execution on the developer or CI machine, which is more dangerous than normal browser-side script execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script extracts JavaScript from ui/index.html and executes it with eval, which creates a code-execution sink tied to file content rather than a fixed imported module. If ui/index.html is modified by a malicious commit, compromised dependency, or untrusted build artifact, running this verification script will execute arbitrary code on the analyst or developer machine with Node.js privileges. In this skill context, the danger is somewhat increased because the repository mixes UI and logic and this helper intentionally bridges browser code into Node, making trust boundaries easy to blur.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

html+='</dl></div>';
    });
    html+='</div>';
    if(rm.note) html+=`<div class="solar-note">${rm.note}</div>`;
  } else {
    html=`<div style="font-size:13px;color:var(--muted)">${rm.note||'暂无补救建议。'}</div>`;
  }

• Confidence: 97% confidence
• Finding: rm.note}</

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

html+='</div>';
    if(rm.note) html+=`<div class="solar-note">${rm.note}</div>`;
  } else {
    html=`<div style="font-size:13px;color:var(--muted)">${rm.note||'暂无补救建议。'}</div>`;
  }
  document.getElementById('remedyBox').innerHTML=html;
}

• Confidence: 97% confidence
• Finding: rm.note||'暂无补救建议。'}</

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

<div class="card">
      <div class="result-head">
        <div class="name" id="rName"></div>
        <div class="meta" id="rMeta"></div>
      </div>
      <h2><span class="num">贰</span>四柱命盘</h2>
      <table id="pillarTable"></table>

• Confidence: 96% confidence
• Finding: rMeta"></

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/audit_hit_distribution.js:30

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/check_conflicts.js:6

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/check_dup_hits.js:6

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/test_dst.js:20

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/test_eval_state.js:10

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/test_liuri_v2.js:7

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/test_liuyue_v2.js:7

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/test_p1_fixes.js:8

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/test_ui.js:10

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/test_xiyong.js:17

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/verify_edu_rules.js:19

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/verify_sleep_rules.js:18

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/verify_ux_e2e.js:19