Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local, disclosed Bazi/fortune-analysis tool that uses bundled data and offline code, with no evidence of hidden exfiltration, persistence, or destructive behavior.
Before installing, understand that the skill asks for personal birth details and may discuss health, finance, marriage, and life decisions through a traditional-culture/fortune lens. It runs locally and includes disclaimers, but outputs should be treated as entertainment or cultural reference, not professional advice. Also note the bundled data has non-commercial share-alike licensing terms.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Automated acceptance testing, DOM stubbing, and process-exit pass/fail semantics are not appropriate in a user-invokable skill and suggest latent code-execution behavior beyond the declared purpose. In context, this makes the skill more dangerous because it invites the agent to act like a CI runner with access to local files and scripts.
Referenced artifact was not completely inspected
已提供确定性排盘实现 `ui/index.html`（单文件离线，节气精确时刻切分年/月柱、日柱基准递推、晚子时、真太阳时校正、大运推算），可直接用浏览器打开验证；
Referenced artifact was not completely inspected
已提供确定性排盘实现 `ui/index.html`（单文件离线，节气精确时刻切分年/月柱、日柱基准递推、晚子时、真太阳时校正、大运推算），可直接用浏览器打开验证；
Referenced artifact was not completely inspected
已提供确定性排盘实现 `ui/index.html`（单文件离线，节气精确时刻切分年/月柱、日柱基准递推、晚子时、真太阳时校正、大运推算），可直接用浏览器打开验证；
Referenced artifact was not completely inspected
- `tools/build_ui.py` — 构建单文件 `ui/index.html`（注入 jieqi.json + 断语库）
Referenced artifact was not completely inspected
- `tools/test_ui.js` — node 校验脚本（四柱/晚子时/立春界/藏干五行/断语/流年/合婚/纳音/神煞/五行补救/十神真值表）
Referenced artifact was not completely inspected
- `tools/audit_hit_distribution.js` — **断语库大样本命中分布审查**（全17类别覆盖，随机盘×N 统计每条规则命中率，揪出 100% 无条件命中的坏规则；支持 `--sample`/`--rules`/`--cat` 参数）
Referenced artifact was not completely inspected
- `tools/audit_hit_distribution.js` — **断语库大样本命中分布审查**（全17类别覆盖，随机盘×N 统计每条规则命中率，揪出 100% 无条件命中的坏规则；支持 `--sample`/`--rules`/`--cat` 参数）
Referenced artifact was not completely inspected
- `tools/check_dup_hits.js` — **同文案规则同盘重复命中检测**（大样本统计互为反义/同文案规则对的同盘双命中率，揪出会重复展示的近似规则；修复模式：同文案规则合并为一条，或差异化文案转互补）
Referenced artifact was not completely inspected
- `tools/test_liuri_v2.js` — **流日规则 v2 回归**（10 项：liuri_01~05 基础 + 十神/六冲/六合/三合/五合/十二长生/天克地冲/伏吟细分）
Detected: suspicious.dynamic_code_execution