MeiHuaYi

• Risk level: Low
• Analyzed: Mar 26, 2026, 1:12 AM
• Findings: 0
• Version: 1.0.5

Overview

The skill's code, instructions and data are coherent with a local MeiHuaYi divination tool; nothing requests unrelated credentials or surprising system access, but it stores user queries/analyses locally and may download a JSON data file at runtime.

This skill appears to be what it claims: a local MeiHuaYi divination tool that logs each session for later review/learning. Before installing or running, consider: (1) Privacy: the skill will save full questions, the entire reasoning chain and conclusions to SQLite files under the skill's data/ directory—these may contain sensitive personal details you provide. If you don't want persistent logs, remove or relocate the data/ files or modify the code that calls save_record/add_feedback/add_note. (2) Network fetch: meihuayi.py will try to download iching.json from a GitHub raw URL if the bundled copy is missing—if you require fully offline operation, ensure data/iching.json is present before running or block network access. (3) Code review: all behavior is in plain Python (no obfuscation, no remote code execution beyond the JSON fetch); you can inspect meihuayi.py, records.py and learning_notes.py before use. (4) Sandboxing: run in a restricted environment if you are concerned about data retention or outbound network access. If you want, I can point to the exact lines that perform database writes and the network download so you can patch or audit them.