Security audit

MeiHuaYi

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a legitimate divination tool, but it automatically retains potentially personal questions and readings in local databases without clear opt-out, deletion, or access controls.

Install only if you are comfortable with the skill keeping local SQLite records of your divination questions, analyses, conclusions, and feedback. Avoid entering identifying, medical, financial, or third-party details unless you manage the local data directory yourself, and be aware that the skill has no documented no-save or delete workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises no explicit permissions, yet its documented behavior includes local file read/write and network access. This creates a transparency and least-privilege problem: users and the hosting platform cannot accurately assess what data the skill can access or where data may go.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose is divination and analysis, but the skill also performs persistent record storage, feedback tracking, learning-note generation, data migration, and external downloads. This mismatch can mislead users into disclosing sensitive information without understanding retention, secondary processing, or outbound data access.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill mandates automatic persistent recording of each user's question, pattern details, analysis, and conclusion in SQLite. For a divination tool, this is not strictly necessary to fulfill the immediate request and increases privacy risk because users may ask highly personal questions that become permanently stored.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: The skill requires users to provide detailed contextual observations such as surroundings, nearby people, sounds, colors, and activities, which exceed the stated scope of time/number-based divination. Even if intended as part of the divination method, collecting this extra context expands the amount of personal and situational data exposed.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The feedback-tracking and self-learning notes workflow introduces a secondary data-processing purpose beyond simple divination. It creates a persistent profile of user cases, outcomes, and error analyses, which broadens retention and reuse of sensitive natural-language content.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The module explicitly introduces persistent local storage for learning notes, which expands the skill from divination/analysis into retaining user-derived history. Even though the code does not show exfiltration or overt abuse, storing interaction content and feedback beyond the declared purpose creates a data-retention/privacy risk and a larger attack surface if sensitive user questions are recorded.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This code implements a durable feedback/training-note database, including reason analysis, lessons learned, and improvement text, which is outside the narrow stated function of generating and analyzing divination results. In practice, users may enter sensitive personal context into these fields, so silent persistence of self-improvement data can create privacy, compliance, and trust issues even without malicious intent.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module performs directory creation and a remote download automatically at import time, which creates hidden side effects unrelated to simply using a divination library. In an agent skill context, import-time network and filesystem writes can violate least privilege, surprise callers, and expand the attack surface if the remote content is unavailable, tampered with, or the environment is sensitive.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill fetches executable-input data from an external GitHub URL without integrity verification. Even though the fetched file is JSON, untrusted remote content can influence program behavior, fail unpredictably, leak metadata through outbound access, and create a supply-chain dependency not disclosed by the skill’s stated purpose.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: Broad invocation phrases like '查看卦例' or '添加反馈' may overlap with ordinary conversation and unintentionally trigger record-query or record-update actions. In a skill that stores sensitive questions and case histories, accidental invocation can expose or alter private data without deliberate user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs automatic saving of every divination record without a clear privacy notice or consent flow. Because divination questions often involve health, relationships, finances, or other intimate topics, silent retention materially increases privacy and disclosure risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow asks for detailed real-world contextual information, potentially including location context and information about nearby people, without warning that such details may be sensitive. Users may overshare situational or third-party information that is unnecessary for core functionality and risky if retained or displayed later.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file contains detailed health and disease interpretations tied to divination symbols, which can cause users to treat occult content as health guidance without any disclaimer that it is not medical advice. In a fortune-telling skill, this is more dangerous because users may consult it during illness and delay or avoid professional diagnosis or treatment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code persistently stores user questions, analyses, conclusions, and later feedback to a local SQLite database without any visible consent, notice, retention policy, or mechanism to disable storage. Because the content can include sensitive personal questions or life circumstances, silent persistence creates a privacy risk if the host system is shared, backed up, or otherwise accessed by others.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The migration routine automatically reads legacy JSON records, imports them into SQLite, and renames the original file to a backup without informing the user or asking permission. This silently expands and preserves historical sensitive data, increasing privacy exposure and making users unaware that older records continue to exist in both the new database and backup file.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Mandating persistent storage of every user's question, full analysis, and related details creates a natural-language data retention risk. These records can contain highly sensitive personal content, and exposing them through later queries or local database access increases the chance of unauthorized disclosure.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill's required collection of detailed contextual information about the user's environment and nearby people expands the amount of sensitive real-world data handled by the system. If stored or later displayed, this can reveal behavioral patterns, location context, or third-party information unrelated to core operation.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill exposes commands to list, search, and display detailed stored divination records containing questions, conclusions, and historical case details. Without clear access controls and consent boundaries, this creates a straightforward disclosure surface for sensitive prior interactions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.