BaZi Insight Report - Cantian AI

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  0.0.3

Overview

This skill matches its stated purpose of creating Cantian BaZi report payment links and checking report status, but users should understand it sends personal birth and contact details to Cantian's service.

Install only if you are comfortable sharing your email, birth date/time, gender, and optional nickname or birthplace with Cantian AI to create a paid report checkout. Review the generated order details and payment page before paying, and keep the returned profileId private.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger conditions are broad enough to match casual phrases like '我要', '我想', or requests about life/love/wealth reports, which can cause the skill to activate in ambiguous contexts. Because this skill can initiate a paid checkout flow and process sensitive personal attributes, overly broad triggering raises the chance of accidental activation, unwanted data collection, or unintended purchase-link generation without sufficiently clear user intent.

VirusTotal

66/66 vendors flagged this skill as clean.