liuyao-divination_六爻分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 2.0.1

Overview

The skill is a coherent divination/reporting workflow, but it needs Review because it persistently writes sensitive reports, recommends unpinned package installation, and generates HTML with unsafe unescaped fields and fixed personal contact branding.

Install only if you are comfortable with a local workflow that can create persistent case folders and reports containing your full question and analysis. Avoid entering highly sensitive personal data, prefer the pure-Python fallback when possible, and do not open or share generated HTML from untrusted or adversarial input until the report generator escapes all user/model-supplied fields and makes branding optional.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/generate_report.py:534

Finding

Mandatory Third-Party Promotion in Generated User Reports

Content

View full analysis

Author: Cyrux | WeChat: drdingno1 | Email: [e-mail]

Six-Line Divination Report

{edition_badge}

Primary Hexagram: {ben_gua}　Changed Hexagram: {bian_gua}

``` The original source uses Chinese presentation text, but the security-relevant fixed values are `Cyrux`, `drdingno1`, and `[e-mail]`. The report workflow is mandatory: ```markdown 5. Invoke the local Python script to generate HTML: python /scripts/generate_report.py -i "{case_directory}/liuyao-data.json" -o "{case_directory}/liuyao-report.html" ``` ### Technical Analysis The report generator contains a fixed author name, WeChat identifier, and email address in its HTML template. These values are not supplied by the user, are not necessary for divination or report generation, and cannot be disabled through the report input. The Skill instructions require the agent to generate the HTML report using this script. Consequently, every normal execution of the Skill produces a user-facing deliverable containing unrelated third-party promotional contact information. This is a stable output-hijacking behavior: loading and following the Skill changes the intended report output by requiring the agent to distribute the embedded attribution and contact details. Although the behavior does not bypass platform safety controls, it repurposes user-generated deliverables as a promotional channel. ### Attack Path 1. A user requests a divination report. 2. The Skill requires the agent to execute the complete workflow, including HTML report generation. 3. The agent invokes `scripts/generate_report.py`. 4. `HTML_TEMPLATE` i ...[truncated 802 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_report.py:747

Finding

Stored HTML and JavaScript Injection Through Unescaped Report Fields

Content

View full analysis

str: ws_cls = wang_shuai_class(step2.get("verdict", "")) parts = [ f'

主用神：{step1["zhu_yong_shen"]}，{step2["yong_shen_location"]}

', f'

辅助用神：{step1["fu_zhu_yong_shen"]}

', f'

月建：{step2["yue_jian"]}　日辰：{step2["ri_chen"]}

', f'

特殊状态：{step2["special"]}

', f'

综合判定：{step2["verdict"]}

', ] if step1.get("note"): parts.append(f'

{step1["note"]}

') return "\n".join(parts) ``` The final verdict is also inserted without escaping: ```python def build_final_block(step7: dict) -> str: trend = step7.get("trend", "") advice = step7.get("action_advice", "") if trend and advice: return ( '

' f'

📈 趋势推演

{trend}

' f'

💡 行动建议

{advice}

' '

' f'

{step7["final_verdict"]}

' ) return f'

{step7["final_verdict"]}

' ``` User-controlled and model-derived values are passed directly into the main template: ```python html = HTML_TEMPLATE.format( ben_gua=meta["ben_gua"], bian_gua=meta.get("bian_gua") or "静卦", question=meta["question"], date=meta["date"], lunar=meta.get("lunar", ""), yue_jian=meta["yue_jian"], ri_chen=meta["ri_chen"], day_kong=day_kong, yue_kong=yue_kong, edition_badge=edition_badge, edition_c ...[truncated 3602 chars]

Remediation

View remediation

` - `` - `` - Closing-tag injection - Quotation-mark and attribute injection 9. Validate imported JSON against a strict schema with maximum lengths and expected enumerated values, while retaining output encoding as the primary defense. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:187

Finding

Unpinned Third-Party Package Installation From the Active Python Package Index

Content

View full analysis

/dev/null && echo INSTALLED || echo NOT_FOUND ``` When sxtwl is not installed: - **A. Install sxtwl (recommended)** — Accurate solar-term and hour calculations, supports all years. Command: `pip install sxtwl` - **B. Pure Python fallback** — No installation required, but only supports 2026-2086. 4. Execute the user's choice: after confirmation, if option A is selected, run `pip install sxtwl`; if option B is selected, continue directly to chart generation. ``` ### Technical Analysis The Skill instructs the agent to install `sxtwl` without specifying: - An audited version. - Package hashes. - A lockfile. - A trusted index URL. - An isolated virtual environment. - A binary-only policy or other build restrictions. `pip install` can execute package installation and build logic with the permissions of the Python environment. The effective package source also depends on the user's pip configuration, environment variables, configured mirrors, and active package indexes. User confirmation makes the installation visible, but it does not protect against a compromised future release, a malicious configured mirror, dependency substitution, or incompatible package changes. No evidence was found that the named package is currently malicious. The finding concerns the unsafe and non-reproducible installation process. ### Attack Path 1. The Skill checks whether `sxtwl` is installed. 2. The package is absent, and the user selects the recommended installation option. 3. The agent runs `pip install sxtwl`. 4. pip resolves the latest matching package from the active configured index. 5. A compromised package release, mirror, dependency, or build process executes installation code. 6. The malicious ...[truncated 811 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个领域功能型六爻占卜/排盘/解卦技能，而提供的代码并未执行任何起卦、排盘、用神分析、旺衰判断、世应/六神/应期推断或解卦逻辑。相反，它的唯一目的在于检查项目内多个文件的发布版本展示是否与 SKILL.md 中的 metadata.version 一致。这属于项目维护/发布质量保障脚本，与宣称的占卜分析核心功能 materially different，因此应判定为明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

该描述与代码存在明显行为不一致。代码核心能力确实与“六爻纳甲排盘”高度相关，能够完成起卦、排盘及多种辅助计算，因此不是完全无关的技能；但声明把能力扩展到了完整“解卦”工作流，包括审题取用神、判定旺衰、追踪动变、伏神分析、世应关系、六神兽取象、应期推断、综合断语、智能体审查、HTML 报告等。当前代码并未执行这些高层解读步骤，只是生成排盘所需的结构化数据和规则化格局检测结果。另一方面，代码还包含描述中未提到的行为：对孕产/胎儿性别相关请求进行拦截，以及从 JSON 文件导入、输出到文件等 I/O 能力。综合看，虽然“排盘”部分匹配，但整体描述夸大了实际功能范围，且遗漏了若干实际行为，应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个完整的六爻占卜应用技能；但给出的代码块是 scripts/test_gua_patterns.py，一个测试脚本。它通过构造测试用例和断言来检查 detect_patterns、GUA64 数据表和 build_paipan_data 的若干字段是否正确，属于内部质量保障代码。虽然测试内容与六爻领域相关，说明它服务于该系统的一部分，但这段代码本身并不执行声明中的核心能力：自动起卦、完整解卦流程、输出断语、生成报告等。因此描述与该代码块的实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction says replies to certain users must use '温和中文提醒', which imposes a specific language on the user interaction. This is a natural-language policy issue because the file does not provide user opt-in, alternative locale handling, or justification for restricting responses to Chinese only.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Including pip install in an agent skill grants a path to fetch and execute third-party code at runtime, which is a strong supply-chain and remote code execution risk. In a divination/reporting skill, that capability is not essential and materially expands the attack surface beyond the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file is entirely written in Chinese and includes prescriptive maintenance instructions, but it does not offer any language choice or explain a region-specific requirement. Under the policy rule for natural-language constraints, forcing a specific language without opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says users can 'just speak' and that the skill will 'automatically activate' for broad natural-language requests such as lost items, health, work, contracts, and lawsuits. This kind of broad trigger surface can cause unintended invocation during ordinary conversation, making the agent perform divination analysis or generate reports when the user did not explicitly request this skill, which is a prompt-scope and workflow integrity problem.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill explicitly instructs file reads, file writes, shell command execution, and package installation, yet it declares no tool scope or permissions boundary. That omission increases the chance the runtime grants broader capabilities than users expect, enabling uncontrolled filesystem persistence and command execution during normal use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description and usage lines describe the skill in broad domain terms like '六爻占卜' and '起卦解卦' without stating explicit trigger phrases, scope boundaries, or negative examples. In a manifest/markdown context, this can make invocation conditions ambiguous because it is unclear exactly when the skill should activate versus when ordinary discussion of divination should not trigger it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill says no external system is needed, yet later instructs runtime installation of an external dependency. This undermines trust boundaries and can trigger unreviewed network access and third-party code installation in environments that expected offline/local-only operation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

Repeatedly directing output to ~/Desktop or fallback home paths creates durable cross-session state outside a sandbox and may expose prior session contents to other users, tools, or processes. Because the folder name is partly derived from user content, it also increases the risk of metadata leakage through filenames even if file contents are never opened.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md

4. **执行用户选择**：用户确认后，若选 A 则 `pip install sxtwl`，若选 B 则直接进入排盘（脚本自动回退）。**若用户选 B 且占卦日期不在 2026-2086 范围内**，Agent 必须提示"此日期超出纯 Python 支持范围，必须安装 sxtwl"并回到 A。
5. **创建卦例临时目录**：intent 确认且 sxtwl 方案确定后，**立即在桌面创建卦例目录**（此时卦名未知，先用临时名）：
    ```bash
    mkdir -p ~/Desktop/YY.MM.DD-事件简称/
    ```
    目录命名为 `YY.MM.DD-事件简称`（如 `26.07.08-工作`），其中事件简称 ≤4 字，自原文提炼。将此路径记为 `{卦例目录}`。临时名只有日期+事件，卦名在排盘后加入。
    > 🌐 **跨平台桌面路径**：`~/Desktop/` 在三平台通用（Windows Git Bash/WSL、macOS、Linux GNOME/KDE）。若 Linux 桌面为中文 locale 且 `~/Desktop/` 不存在，改用 `~/桌面/`；若两者均不存在，回退到 `~/.liuyao/cases/`（自动创建，不污染主目录）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

Repeatedly directing output to ~/Desktop or fallback home paths creates durable cross-session state outside a sandbox and may expose prior session contents to other users, tools, or processes. Because the folder name is partly derived from user content, it also increases the risk of metadata leakage through filenames even if file contents are never opened.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md

4. **执行用户选择**:用户确认后,若选 A 则 `pip install sxtwl`,若选 B 则直接进入排盘(脚本自动回退)。**若用户选 B 且占卦日期不在 2026-2086 范围内**,Agent 必须提示"此日期超出纯 Python 支持范围,必须安装 sxtwl"并回到 A。
5. **创建卦例临时目录**:intent 确认且 sxtwl 方案确定后,**立即在桌面创建卦例目录**(此时卦名未知,先用临时名):
    ```bash
    mkdir -p ~/Desktop/YY.MM.DD-事件简称/
    ```
    目录命名为 `YY.MM.DD-事件简称`(如 `26.07.08-工作`),其中事件简称 ≤4 字,自原文提炼。将此路径记为 `{卦例目录}`。临时名只有日期+事件,卦名在排盘后加入。
    > 🌐 **跨平台桌面路径**:`~/Desktop/` 在三平台通用(Windows Git Bash/WSL、macOS、Linux GNOME/KDE)。若 Linux 桌面为中文 locale 且 `~/Desktop/` 不存在,改用 `~/桌面/`;若两者均不存在,回退到 `~/.liuyao/cases/`(自动创建,不污染主目录)。

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide explicitly instructs writing structured JSON and a rendered HTML report to local disk, and the schema includes the user's question and detailed interpretive content. Without clear consent, retention limits, or storage warnings, sensitive user queries may be persistently stored in predictable files and later exposed to other local users, backups, sync services, or support workflows.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The md_full requirement mandates verbatim inclusion of full prior-step markdown content in the final report, which can preserve and re-expose any sensitive personal details contained in the user's question or analysis. Because the policy forbids summarization or redaction, it increases the chance of unnecessary data disclosure in shareable artifacts like HTML reports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template hard-codes <html lang="zh-CN">, which imposes a specific language/locale. Under the policy, locale constraints should either be user-selectable or clearly documented as justified; this file does not provide either.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The validation step requires checking that unique sentences from prior markdown appear verbatim in the final HTML, reinforcing exact reproduction of potentially sensitive content rather than minimizing it. This operationalizes disclosure risk by making faithful replay of full text a success criterion for report generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains extensive operational instructions only in Chinese, and nowhere indicates that users may choose another language or that Chinese is required for a justified region-specific purpose. That creates a natural-language policy concern because the skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill file is written in Chinese and provides no indication that other languages are supported or that Chinese is a required, region-specific constraint. Under the language/locale policy rule, this is a natural-language policy concern because it effectively imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file embeds its primary docstring, comments, and user-facing console output entirely in Chinese, which imposes a specific language/locale on users of the script. The file does not offer any language selection, fallback, or documented region-specific justification, matching the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This file is entirely in Chinese and does not provide an alternative language option or indicate that the skill is intended only for a Chinese-language audience. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all instructions and reference content exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the natural-language policy rule, forcing a specific language without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This markdown file presents all instructional/reference content exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the natural-language policy criteria, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire skill reference is written in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

Manifest 将技能描述为六爻排盘与解卦，但本文件额外规定把结构化结果落盘为 liuyao-data.json，再产出 liuyao-report.html 交付件。虽然报告生成与技能流程有关，但本地文件写入属于额外能力；若清单未明确该交付/落盘能力，其正当性弱于核心解卦目的。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template hard-codes the document language as zh-CN, and the script's user-facing strings are also exclusively in Chinese. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.