T08 · Insecure Dependencies
Warning
- Location
SKILL.md:24- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
MeiHuaYi
Security checks for vulnerabilities and agentic risk
Overview
The skill performs the advertised divination workflow, but it automatically keeps potentially sensitive readings in local databases and has an unverified remote data fallback.
Install only if you are comfortable with readings, questions, contextual observations, feedback, and derived notes being stored locally in plaintext. Use a separate environment, pin dependencies yourself, avoid sensitive personal details, and treat the GitHub data fallback as untrusted unless the bundled data file is present and verified.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
meihuayi.py:10- Finding
Mutable Remote Data Downloaded Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
records.py:27- Finding
Potentially Sensitive User Records Stored in Plaintext Without Retention Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented purpose is a divination/charting skill, but the file also specifies persistent recordkeeping, feedback management, and learning-note features that are not reflected in the high-level description. This mismatch can mislead users and reviewers about what data is collected and retained, undermining informed consent and making risky behavior less visible.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 72% confidence
- Finding
The skill documentation describes capabilities that imply file read/write and possibly network use, but it declares no explicit tool scope or permissions. This creates an authorization transparency problem: a reviewer or runtime may not clearly understand what the skill is allowed to access, increasing the risk of over-broad execution if the platform permits those tools by default.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises divination and analysis, but this section mandates automatic persistent storage of user questions, timing, full chart data, reasoning, and conclusions. That is a material hidden behavior because users may disclose intimate personal concerns during divination without realizing they are being retained by default.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section requires automatic saving of each divination record, including user questions and analysis, without a clear privacy warning or consent step. Because divination prompts often involve relationships, health, finances, or career concerns, silent persistence creates meaningful privacy and confidentiality risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions require default retention of user questions, chart details, reasoning, and conclusions, creating a broad data collection and storage pipeline without minimization. This is dangerous because it normalizes keeping sensitive personal narratives and inferred judgments that could be exposed later through local access, backups, or record browsing.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The agent is directed to solicit personal contextual details about the user's environment and activity, then incorporate them into analysis. That expands the collected dataset with potentially sensitive behavioral and situational information, increasing privacy risk without clear necessity or safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to ask for contextual details such as location, surrounding people, sounds, colors, and current activity, but it provides no privacy warning or minimization guidance. These details can reveal sensitive situational or personal information beyond what is necessary for the stated entertainment purpose.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The record schema and examples instruct storing and displaying full questions, conclusions, feedback, and detailed histories, which can contain highly sensitive personal content. Broad retention plus later detailed display raises the likelihood of accidental disclosure to other local users, operators, or future sessions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a 梅花易数卜卦 system that supports casting hexagrams, arranging charts, and performing divination analysis. This file instead implements a separate local learning-notes subsystem that records case feedback, stores correctness labels, and computes performance statistics, which is a broader behavior than the manifest claims.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module title, purpose description, and all user-facing CLI help/output are written only in Chinese, indicating a fixed language expectation. Under the policy rule, a skill should not force a specific language unless it explicitly offers user opt-in or documents a justified region-specific constraint.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code silently creates a local SQLite database and persists user-derived content without any visible consent, retention controls, or access restrictions. In a divination-style skill, stored notes may include sensitive personal questions or reflective text, so undisclosed persistence increases privacy and data-handling risk even though the database access itself is local.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The module description and user-facing output strings are Chinese-only, which effectively forces a specific language for interaction. The file does not offer language selection or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module automatically creates a local directory and downloads a JSON file from a remote URL, which exceeds the expected scope of a local divination skill and introduces a supply-chain and integrity risk. Because this happens automatically, a compromised upstream source, MITM in a misconfigured environment, or unexpected network access could alter behavior or write untrusted content to disk without explicit user approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatic network download and file creation at import time without confirmation is a genuine security weakness because it performs privileged actions implicitly. In this skill context, users expect deterministic local divination logic, not background setup that contacts external services and mutates the local environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
A divination/calculation skill generally has no need for runtime remote fetch capability, so the presence of network download logic is context-inappropriate and increases attack surface. Even though the URL is hardcoded, fetching executable inputs or operational data from GitHub at runtime creates dependency on external content that may change or become unavailable.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module docstring is entirely in Chinese and presents the skill's purpose and behavior only in that language. Because this is natural-language user-facing guidance in a code file, it imposes a specific language without any opt-in, alternative locale, or justification that the skill is region-specific.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill description omits that stored divination records can later be queried, listed, and viewed in detail. Retrieval features increase the exposure surface for previously stored sensitive content because they enable later browsing of a user's private questions and outcomes.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The learning-notes subsystem derived from user feedback is not disclosed in the main skill description, even though it creates additional derived data about the user's cases. Undisclosed secondary processing is risky because users may not expect their feedback to be transformed into longer-lived training-style notes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON file contains user-facing natural-language scripture strings exclusively in Chinese, with no indication that the skill offers a language choice or that the locale restriction is intentional. Under the language/locale policy, forcing a single language without user opt-in can be a policy concern.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code triggers directory creation and possible network download as soon as the module is imported, causing hidden side effects before any explicit user action. This is dangerous because merely loading the skill can modify the filesystem and initiate outbound connections, violating least surprise and making safe review or sandboxing harder.
- Content
Static analysis
No suspicious patterns detected.