Ziwei Bazi Consulting

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:05 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed compatibility alias, but it runs an unpinned Python file from a sibling package outside the reviewed artifact.

Install only if you already trust the separately installed destiny-fusion-pro package at the expected sibling path. Review or pin that package as the real executable payload, because this alias will run its Python code with the agent's normal permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/fortune_fusion.py:12

Finding

Unverified External Python Code Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/fortune_fusion.py, lines 12–18
Vulnerability Type: Unverified execution of an external sibling dependency
Risk Level: Medium

Vulnerable Code

python

target = (
    Path(__file__).resolve().parents[2]
    / "destiny-fusion-pro"
    / "scripts"
    / "fortune_fusion.py"
)
runpy.run_path(str(target), run_name="__main__")

Technical Analysis

The compatibility wrapper constructs a path outside the audited project and executes the referenced Python file in-process through runpy.run_path. It does not validate the target's ownership, integrity, version, cryptographic digest, or location within an approved dependency root.

The delegated file is therefore part of the effective executable payload despite not being included in the reviewed project. An attacker who can create or replace the expected sibling file can cause arbitrary Python code to run when this wrapper is invoked. Because runpy.run_path executes the target in the current Python process, the delegated code inherits the wrapper's operating-system identity, environment, accessible files, and available network permissions.

Attack Path

1. The attacker obtains write access to the directory containing the expected destiny-fusion-pro sibling project or otherwise controls how that dependency is installed.
2. The attacker creates or replaces destiny-fusion-pro/scripts/fortune_fusion.py with malicious Python code.
3. A user or automation invokes scripts/fortune_fusion.py, including through the command documented in SKILL.md.
4. The wrapper resolves the attacker-controlled sibling path without performing an integrity or trust check.
5. runpy.run_path executes the substituted file as __main__.
6. The malicious code operates with the same privileges and resource access as the invoking process.

Impact Assessment

Successful exploitation permits arbitrary code execution under the operating-system account running the sk ...[truncated 456 chars]

Remediation

View remediation

Remediation Suggestions

1. Package the required implementation inside the reviewed skill so that all executable code is included in the same integrity and review boundary.
2. If an external dependency is necessary, install it through a controlled package mechanism with an exact version and verified hashes.
3. Resolve delegated code only from a configured, trusted root rather than deriving an implicitly trusted sibling path.
4. Before execution, verify the target is a regular file, resolves beneath the approved root, and matches a pinned cryptographic digest or signed release.
5. Reject symbolic links and unexpected ownership or permission states where the deployment model permits those checks.
6. Fail closed with a clear error if the dependency is absent or any validation fails.
7. Prefer importing a narrowly scoped, versioned API over executing an entire external file as __main__.
8. Ensure the process runs with least privilege to reduce the impact of any future dependency compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document presents both Chinese and English external names as fixed recommendations, but does not indicate that the user can choose their preferred language or locale. Under the policy, forcing or assuming a language without explicit opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.