Ziwei Doushu

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:08 PM UTC
• Version: 1.0.2

Overview

This skill appears to perform local Ziwei Doushu chart calculations and optional chart export without hidden network, credential, or persistence behavior.

Install and run this skill in a normal non-privileged workspace, pin and review Python/npm dependencies before use, and choose an explicit chart output path to avoid overwriting an unintended file. Expect primarily Chinese output and note that the optional JS engine path may need additional dependency setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/ziwei_chart.py:228
• Finding: Unpinned and Unlocked Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/ziwei_chart.py:228-233` - `scripts/ziwei_chart.py:838-847` - `scripts/ziwei_engine_js.mjs:2` **Vulnerability Type**: Third-party supply-chain exposure through unpinned installation guidance and missing dependency lockfiles **Risk Level**: Medium ### Vulnerable Code ```python def _ensure_iztro_py() -> Any: try: from iztro_py import astro except ModuleNotFoundError as exc: raise RuntimeError("未安装 iztro-py，请先安装：pip install iztro-py") from exc return astro ``` ```python def render_jpg_cairosvg(svg: str, quality: int = 92) -> bytes: try: import cairosvg except ModuleNotFoundError as exc: raise RuntimeError("生成 JPG 需要 cairosvg，请先安装：pip install cairosvg") from exc try: from PIL import Image except ModuleNotFoundError as exc: raise RuntimeError("生成 JPG 需要 pillow，请先安装：pip install pillow") from exc ``` ```javascript import { astro } from 'iztro'; ``` ### Technical Analysis The runtime error messages recommend installing `iztro-py`, `cairosvg`, and `pillow` without exact version constraints or package hashes. The JavaScript engine imports `iztro`, but the audited project contains no `package.json`, package lockfile, or integrity metadata defining the reviewed dependency version. The payload includes broad version requirements such as `iztro-py >=0.3.4` and `iztro >=2.5.7`, but these are informational values rather than enforced, reproducible dependency controls. An installation can therefore resolve to a newer and materially different package or transitive dependency than the version reviewed by the project author. The project does not automatically run a package manager and contains no evidence that the named dependencies are currently malicious. Exploitation is conditional on a user or deployment process following the unrestricted installation guidance or otherwise installing dependencies without a trusted lockfile. ### A ...[truncated 1622 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a reviewed Python dependency manifest with exact versions, such as a fully pinned `requirements.txt` or lockfile. 2. Generate and verify cryptographic hashes for Python artifacts, and install them with hash enforcement, for example through `pip install --require-hashes`. 3. Add `package.json` and a committed package lockfile for the JavaScript engine. Use reproducible installation commands such as `npm ci`. 4. Pin the exact reviewed `iztro`, `iztro-py`, `cairosvg`, and Pillow versions rather than relying on open-ended minimum versions. 5. Review and lock all transitive dependencies, not only direct dependencies. 6. Use an approved package registry or internal mirror and enable dependency provenance, vulnerability, and integrity checks where supported. 7. Replace unrestricted runtime installation suggestions with references to the project's locked installation procedure. 8. Run dependency installation and chart generation as a non-privileged user in an isolated environment with only the filesystem and network permissions required by the Skill. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs use of a shell command (`python scripts/ziwei_chart.py ...`) and mentions optional chart export, which implies code execution and likely file creation, but it does not declare any explicit tool scope such as allowed tools or permissions. In an agent environment, this can cause the model to invoke shell or write-capable tools more broadly than intended, increasing the risk of unauthorized command execution or filesystem changes if user-controlled parameters are passed through unsafely.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Across validation errors, CLI help text, generated report headings, and output content, the skill is hard-wired to Chinese text and Chinese-specific labels. This is a natural-language locale constraint applied by default, and the file does not offer opt-in, language selection, or documentation justifying a mandatory Chinese-only experience.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The manifest describes an offline Ziwei Doushu consultation skill that performs local chart calculations and reporting. In addition to those expected behaviors, this code spawns an external `node` process via `subprocess.check_output`, introducing process-execution capability that is broader than what a chart-calculation/reporting skill inherently requires.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

args.extend(["--year", str(year), "--anchor-date", anchor_date])

    try:
        out = subprocess.check_output(args, text=True)
    except FileNotFoundError as exc:
        raise RuntimeError("当前环境缺少 node，无法启用 JS 备用引擎") from exc
    except subprocess.CalledProcessError as exc:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The call to `astro.bySolar` hard-codes the locale `'zh-CN'`, which means the skill always produces Chinese-localized output regardless of user preference. This is a natural-language policy concern because the file provides no opt-in, fallback, or documented reason for enforcing a specific language/locale.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file is entirely written in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Description-Behavior Mismatch

Low

• Confidence: 82% confidence
• Finding: The manifest mentions optional chart images as part of the consultation output, so image generation itself is expected. However, this implementation allows writing generated SVG/JPG files to a caller-specified path (`--chart-out`) or the current working directory, which is a broader filesystem side effect than the description emphasizes.

Static analysis

No suspicious patterns detected.