易经占卜 I Ching Divination

• Outcome: Review
• Latest audit: May 28, 2026, 1:24 PM
• Version:
  1.0.0

Overview

This looks like a coherent local I Ching divination skill, but it needs review because its instructions can place user text into a shell command.

Review before installing. Use it only for reflective or entertainment-style divination, not financial, medical, legal, safety, or other high-stakes decisions. If installed, ensure the agent invokes `scripts/divine.py` with safe argument passing instead of substituting raw user text into a shell command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger description is broad enough to overlap with ordinary requests for advice or decision support, which can cause unintended activation of the skill. In an agent setting, overbroad routing can expose user prompts to the wrong tool, produce unwanted mystical/fictional guidance in place of normal assistance, and create prompt-routing abuse opportunities if attackers intentionally phrase requests to force this skill to run.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: The skill is documented as operating in Chinese by default without any visible locale negotiation or user opt-in. This can lead to incorrect or opaque outputs for users in other languages, undermining informed consent and increasing the chance that the agent invokes the skill in a context the user does not understand.

VirusTotal

66/66 vendors flagged this skill as clean.