命理咨询入门工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.1

Overview

This astrology skill is not clearly malicious, but it asks for command and write access while advertising unrelated finance/data-analysis uses that could cause it to run in the wrong context.

Review this skill before installing. It appears to be a local Bazi astrology helper, but its metadata and trigger text are much broader than that purpose and it declares write plus command execution authority. Install dependencies only in an isolated environment, prefer pinned versions, and avoid letting the skill auto-run for generic finance, reporting, or data-analysis requests.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:139

Finding

Unpinned Third-Party Dependencies Installed from a Mutable Package Index

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 139 and 226-227
Vulnerability Type: Supply-chain exposure through unpinned Python dependencies
Risk Level: Medium

Relevant code snippets:

bash

# Dependency installation
pip install lunardate sxtwl

markdown

| lunardate | Python library | Required | `pip install lunardate` (lunar calendar calculation) |
| sxtwl | Python library | Optional | `pip install sxtwl` (precise chart calculation) |

Technical Analysis

The skill instructs users or agents to install lunardate and sxtwl without specifying reviewed versions, cryptographic hashes, a lockfile, or a trusted package repository. Consequently, package resolution depends on the mutable state of the default Python package index at installation time.

Python packages can execute package-controlled build or installation logic. If a dependency account or release is compromised, an unsafe future version is published, or package resolution is redirected to an untrusted index, following these instructions could execute attacker-controlled code with the privileges of the agent or user running pip.

The quick-start instruction installs both packages even though the dependency table describes sxtwl as optional. This unnecessarily increases the supply-chain attack surface.

There is no evidence that either named package is currently malicious. The confirmed issue is the unsafe, non-reproducible dependency installation practice.

Attack Path

1. An attacker compromises a dependency distribution channel, maintainer account, package release, or configured Python package index.
2. The attacker publishes a malicious version under a dependency name used by the skill.
3. A user or agent follows the documented pip install lunardate sxtwl instruction.
4. Because no versions or hashes are specified, pip resolves the attacker-controlled release.
5. Malicious build, installation, or i ...[truncated 666 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a specifically reviewed version, for example through a version-controlled requirements file.
2. Generate and enforce cryptographic hashes with a command such as pip install --require-hashes -r requirements.txt.
3. Use a lockfile or reproducible package-management workflow.
4. Explicitly identify the approved package repository and prevent fallback to untrusted indexes.
5. Install dependencies in an isolated virtual environment or sandbox under a non-privileged account.
6. Remove sxtwl from the default installation command if it is genuinely optional.
7. Review package provenance and vulnerability information before updating pinned versions.
8. Include the dependency manifest in the project so the documented setup can be independently reviewed.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:22

Finding

Skill Declares File-Write Capability Without a Documented Functional Requirement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-25
Vulnerability Type: Excessive tool permissions and failure to enforce least privilege
Risk Level: Low

Relevant code snippet:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill requests read, exec, and write capabilities. Its documented purpose is to calculate and return Bazi chart information, and the documented workflow does not identify a requirement to create, overwrite, or modify files.

Declaring an unnecessary write capability expands the authority available during skill execution. If subsequent instructions, user-controlled input, a dependency, or the unspecified execution component were compromised, the granted capability could be used to modify files accessible to the agent.

This is a least-privilege weakness rather than evidence that the current skill intentionally writes malicious content. The project contains only SKILL.md; no supplied script was found that exercises the declared write permission.

Attack Path

1. The skill is loaded with its declared write capability enabled.
2. An attacker influences a later instruction, runtime input, dependency, or execution path.
3. The compromised path invokes the unnecessarily available write tool.
4. Files within the agent's permitted write scope are created or modified.
5. The modification could alter project data, configuration, or other user-accessible files, depending on the platform's sandbox boundaries.

Impact Assessment

Exploitation could permit unauthorized modification or deletion of files within the agent's existing write scope. It does not, by itself, grant operating-system privileges beyond those already assigned to the agent, and no privilege-escalation mechanism is present in the reviewed file.

The practical scope therefore depends on platform enforcement. In a tightly sandboxed environment, exposure may be limited to ...[truncated 120 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove write from the declared tool list unless a concrete file-output feature requires it.
2. If exporting results is required, restrict writes to a dedicated output directory using platform sandbox controls.
3. Require explicit user approval before overwriting existing files.
4. Replace broad command execution with narrowly scoped calculation operations where supported.
5. Apply allowlists to executable commands, arguments, and writable paths.
6. Run the skill under a non-privileged account with access limited to the minimum necessary workspace.
7. Document each requested permission and the exact feature that requires it.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description includes overly broad trigger phrases unrelated to the skill’s domain, such as generic data analysis and visualization tasks. In tool-selection systems, these collision-prone phrases can cause the skill to activate for many unrelated prompts, creating a prompt-routing vulnerability where a locally executing skill with read/write/exec permissions is invoked outside its intended context.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The capability scope enumerates vague keywords such as data analysis, reporting, statistics, visualization, automation, and team workflows, greatly expanding the chance of accidental or inappropriate invocation. Because the skill also advertises exec and write capabilities, misrouting is more dangerous here than for a passive reference skill: an irrelevant prompt could still result in local command execution or file operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest advertises broad data-analysis, reporting, statistics, and visualization use-cases that are unrelated to the documented Bazi fortune-telling functionality. In an agent ecosystem, this kind of scope mismatch can cause the skill to be auto-selected in unrelated workflows and then gain access to read/exec/write capabilities under false pretenses, increasing the chance of unintended execution or data exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation claims support for generic create/query/export operations even though the rest of the file describes a read/analysis-oriented local astrology tool. This ambiguity can mislead an orchestrator or user into granting broader trust and using the skill in workflows involving file generation or data handling that were never clearly defined, which is especially risky because the skill declares write and exec tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example output configuration sets language: "zh-CN", which indicates a fixed language/locale. The document does not present this as optional user preference or explain a necessary region-specific constraint, so it may violate language-choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.