Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese fortune/personality tool that stores its own local profile data and uses OceanBus services, with some privacy and supply-chain caveats but no evidence of malicious behavior.
Install only if you are comfortable with a Chinese-language skill analyzing your agent conversation context to create a behavioral profile, storing derived state under ~/.lucky-lobster, and sending limited profile metadata/OpenID through OceanBus for calendar, story, and recommendation features. For stronger safety, prefer a version that pins dependencies, verifies the downloaded font, and documents all remote fields in the consent prompt.
src/card-generator.js:23Unverified Remote Font Is Persistently Downloaded and Processed by Native Libraries
src/profile.js:12Private Behavioral State Files Rely on Process Umask for Access Control
package.json:11Security-Sensitive Runtime Dependencies Are Range-Pinned Without a Lockfile
This is another true description-behavior mismatch affecting privacy and trust boundaries: the skill advertises narrowly scoped behavioral analysis and minimized disclosure, yet code-level findings indicate undisclosed recommendation telemetry and card-generation storage that are not reflected in the declaration. In a skill that analyzes user conversations and memories, hidden or undocumented outbound actions materially increase the risk of privacy leakage and informed-consent failure.
This is another true description-behavior mismatch affecting privacy and trust boundaries: the skill advertises narrowly scoped behavioral analysis and minimized disclosure, yet code-level findings indicate undisclosed recommendation telemetry and card-generation storage that are not reflected in the declaration. In a skill that analyzes user conversations and memories, hidden or undocumented outbound actions materially increase the risk of privacy leakage and informed-consent failure.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
B6zoBn1tNw2Q7HzCpavA/I5AgcAA0lByXzgB5y0x3Cw6JPGQvKgvzzRISW7GQIOeB2Ttlc2cGcSgD4ZYkyZTRDsACulhtLIZ+1IAChAAC98InAABOgGnAnljpsjTCG1/hNjnwrq4QRhvA5xbCR9qUNe2HQASIFN2R2sK9oA0jCXA/0G3Sj40ArN1bPBtTVH69N/hM4hwDoIdbI1SA1nn2cxnXHhnsDSAtwe+j34UNZ6+0XZptFMa5pAb+POFrEGOAn2LRdN8OmcdhcAAAKYBS+QfAs5OyB4z8OTsDGLflitPgj8tdummxW7Lkc/0jrhwWCs4IkU+a96OfbzWrny01DTSgPMDv+yZHZEG6b/gh14svKHoiugfBM9gBsP5q9yVBmbHPgCUIBEvMe2IPSpyGfHv2Xk5gwPIqjbZOqq+gxtqSSzIvtUMd6WZUmb/dv2mdmDJzsb1ztDPDiE61PGRGVTkah9NPavHw667Ci0/V5DQqqkjiboMTlsMrsibryH+zWTKuyhcgZYNgTAt5teF+p5S9E7LQnyBGY2dGx3UjD7Sffbz2lMbIU+fjIGlWaIAAFTGDQAFPlzZV6mhIKfUQgFpLsgSEjq3t3RmwwHjFOgVZBt1H+0l7u4EAfs1rnjjDHYRQT7t2GIcuO4uNTjU95oGbayoqffBAooBdNMny8SX0Q2jpB7HOs3psaOXn320jqA17fuKsdxOlC2V2zopun0BbUofEi8qmEXfshRm1mwEtXpm8u6CIByMKab04kFwmz/UYmtqxvLzMXpEjXjOXR50jfGKA0VT+zlPLcIBFGvwLQvx94NQZVRhjUeEN+9WnUq2tsKfaDJs3N5H9DW0dNoNRKxMtqOjcf/FJjI0TFiXwYCq0fd8ADr5+JPUVe15wlt2SOuMNyDCZs1XLoBTbpX9tjjNIuHFLU8c+WQ7we7ZiuJZXjOtAm0o4KMSljPXQhDdh6K4HgMHdaGG0N/gXbYqLVT/ezNk6SgKpxyA
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
/**
* OB Identity bootstrap — SDK FileKeyStore with 0o600 permissions.
*
* SDK v0.14.2 FileKeyStore handles persistence at ~/.lucky-lobster/ob-credentials.json
* with mode 0o600 (owner read/write only). Identity is auto-restored on subsequent starts.
*/
import os from "node:os";
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
/**
* OB Identity bootstrap — SDK FileKeyStore with 0o600 permissions.
*
* SDK v0.14.2 FileKeyStore handles persistence at ~/.lucky-lobster/ob-credentials.json
* with mode 0o600 (owner read/write only). Identity is auto-restored on subsequent starts.
*/
import os from "node:os";
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
/**
* OB Identity bootstrap — SDK FileKeyStore with 0o600 permissions.
*
* SDK v0.14.2 FileKeyStore handles persistence at ~/.lucky-lobster/ob-credentials.json
* with mode 0o600 (owner read/write only). Identity is auto-restored on subsequent starts.
*/
import os from "node:os";
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
/**
* OB Identity bootstrap — SDK FileKeyStore with 0o600 permissions.
*
* SDK v0.14.2 FileKeyStore handles persistence at ~/.lucky-lobster/ob-credentials.json
* with mode 0o600 (owner read/write only). Identity is auto-restored on subsequent starts.
*/
import os from "node:os";
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
/**
* OB Identity bootstrap — SDK FileKeyStore with 0o600 permissions.
*
* SDK v0.14.2 FileKeyStore handles persistence at ~/.lucky-lobster/ob-credentials.json
* with mode 0o600 (owner read/write only). Identity is auto-restored on subsequent starts.
*/
import os from "node:os";
The documentation says the skill performs 'zero user input' analysis from memory, session history, and loaded files, which expands the effective data collection scope beyond the higher-level description. In a personality/profiling skill, this creates a real privacy and transparency risk because users may not understand that local files and broader session context are being mined for behavioral inference.
Claiming analysis of memory, session history, and loaded files without an explicit activation-time privacy warning is a real privacy problem. Even if data is intended to stay local, the skill performs sensitive profiling on broad contextual inputs, which can reveal personal, professional, or confidential information without sufficiently informed consent.
The trigger phrase “看运势” is very broad and plausible in ordinary conversation, so the skill may activate when a user is merely discussing fortunes rather than explicitly intending to invoke the skill. In a skill that analyzes conversation history, local memory, and persists identity data, accidental activation increases privacy and consent risk because sensitive processing can begin without clear user intent.
The skill declares network, filesystem, and environment-related behavior but does not define an explicit tool scope such as allowed tools or permissions. In an agent environment, that weakens containment and reviewability, making it easier for the skill to access more host capabilities than users expect, especially given that it processes conversations, stores local identity material, and performs outbound requests.
The skill mandates a Chinese output style ("温暖、简短、不啰嗦") and the rest of the required user-facing formats, prompts, and examples are all specified in Chinese, with no indication that the user can choose another language. This is a natural-language locale policy concern because it imposes a specific language by default rather than documenting user choice or a justified regional constraint.
The manifest presents the title, description, and configuration descriptions entirely in Chinese, with no indication that users can choose another language or opt in to a Chinese-only experience. Under the policy for natural-language violations, forcing a specific language without user choice is reportable unless the locale restriction is clearly documented and justified.
The file’s natural-language content, labels, and generated user-facing strings are entirely in Chinese, and there is no indication that the user can opt into another language or locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The file header and rendering logic describe and implement a Chinese-only card generator, including a Chinese font cache and Chinese text rendering fallback, but there is no indication that users can choose another language or explicitly opt into this locale restriction. Under the policy, language constraints should either be optional or clearly justified as region-specific.
The module documentation explicitly states the card generator is local-only and does not call external APIs, but the implementation performs outbound HTTPS requests on first use to download a font from GitHub or jsDelivr. This is a trust-boundary violation and hidden network behavior: even if no user dialogue is sent, undeclared egress can surprise users, break security assumptions, and create supply-chain risk if the remote asset changes or is intercepted via a compromised upstream.
This JSON corpus stores all titles, stories, morals, and tags in Chinese, but provides no natural-language indication that the skill is Chinese-only or that users can choose their preferred language. Under the policy, forcing a specific language without user opt-in is a reportable locale-policy issue.
This JavaScript file defines all user-facing dimension names, labels, descriptions, type names, and summaries in Chinese only. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue, and this file contains no indication that Chinese is optional or that the skill is intentionally region-specific.
The consent instruction tells the user to say 看运势 again, imposing a specific Chinese phrase as the follow-up interaction. This is a natural-language locale constraint without opt-in or an offered alternative, which can violate language-choice policy.
The fortune flow can transmit user-related data such as city and profile-derived attributes to a remote L1 service after only a generic consent gate in this file, without a nearby, explicit disclosure of what fields are sent for that action. In privacy-sensitive skills that build behavioral profiles, insufficiently specific notice can mislead users about remote processing and increase the risk of unwanted personal-data exposure.
The discovery actions send the user's OceanBus OpenID to the remote L1 service, but the stated data-flow description only mentions sending a 5-dimensional behavior code, city-level location, date, and an anonymous OpenID for fortune-related services. This creates a transparency and privacy issue because an identifier is transmitted for additional features without clear disclosure or purpose limitation in the visible skill contract.
The file hard-codes Chinese-language weekday names and date display strings such as '周日' and '年/月/日', and all solar-term labels are returned only in Chinese. This imposes a specific language/locale in user-visible output without any option to choose another locale or explicit justification that the skill is region-specific.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
});
}
export async function stopListening() {
if (_ob) {
try { await _ob.destroy(); } catch (_) {}
_ob = null;
The manifest centers on behavioral profiling, daily fortune, cultivation reminders, and sending limited metadata to obtain almanac data, classical stories, and community skill/public-course recommendations. CLAUDE.md exposes separate direct discovery actions and a DiscoverySvc flow, making recommendation retrieval a first-class operational capability rather than a supporting detail to fortune generation.
No suspicious patterns detected.