Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese divination/charting skill that runs pure Node.js calculations and does not show credential access, network activity, persistence, or destructive behavior.
Install only if you want Chinese-language 奇门遁甲 charting and interpretation. Treat health, legal, investment, and other high-impact readings as cultural reference rather than professional advice, and ask explicitly before creating Feishu documents or sending email because those outputs are claimed in documentation but not implemented in the local scripts.
该代码的核心目的仍然是奇门遁甲排盘，因此与声明的领域方向一致，不存在越权、资源访问或无关触发词问题。但声明明显夸大了实现范围。实际代码只覆盖了基础排盘引擎：节气、干支、拆补法定局、地盘/天盘/人盘/神盘、空亡、马星、六仪击刑等。声明中的多项关键能力——尤其置润法、格局自动识别、天干克应分析、分类解盘、使用指南——均未在代码中出现，属于描述与实际行为的重大不一致，因此应判定为 mismatch。
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
| `scripts/engine.js` | 排盘核心引擎（节气、定局、四盘排列） |
Referenced artifact was not completely inspected
| `scripts/format.js` | 盘面格式化输出（九宫格、文本） |
The trigger list includes broad everyday terms such as '吉凶' and '吉方', which can cause the skill to activate in unrelated conversations. In an agent environment, overbroad activation can lead to unintended tool use, confusing outputs, and execution of local scripts when the user did not explicitly request this skill.
The entire document is written only in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
This code contains natural-language strings and comments indicating the formatter produces Chinese-language output, and all user-facing formatted text is hard-coded in Chinese. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the regional constraint is explicitly justified.
This JavaScript skill contains natural-language strings entirely in Chinese, including its module description and all returned user-facing summaries and advice. Because the file forces a specific language with no opt-in or fallback, it creates a locale policy violation under the natural-language policy rules.
The example trigger scenarios are all positive examples and do not define what should not activate the skill. This ambiguity increases the chance of accidental invocation, especially because the skill is for divination-style analysis and may be triggered by loosely related phrasing about luck, travel, or timing.
Line L297 says the skill '默认使用拆补法', imposing a default methodological choice in natural language. While this is not a language/locale issue, it is the closest policy-like constraint in the file; however, it does not clearly violate the stated SQP-3 scope, so confidence is limited.
SQP-3 applies to all file types and covers natural-language language/locale policy violations. This markdown file presents all instructions and content exclusively in Chinese, with no user opt-in, alternative language, or stated region-specific justification.
This markdown file is entirely written in Chinese and does not indicate that the language is optional or user-selectable. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.
This markdown file contains end-user instructional content exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable.
This markdown file contains user-facing natural language only in Chinese and does not indicate that the language is optional or that the skill is intended solely for a Chinese-language context. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.
This JavaScript file uses Chinese-only natural-language descriptions and a user-facing Chinese error message, such as the thrown text at L721, with no indication that other languages are supported. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
This JavaScript skill is written entirely around Chinese-language domain terms and emits Chinese-only names/descriptions such as comments, labels, and result text. Under the policy, language constraints should not be forced without opt-in unless clearly documented as intentionally region- or locale-specific, which is not stated in this file.
This code hard-codes Chinese-language descriptions and output strings for the CLI experience, and no option or opt-in mechanism is provided for other languages. The policy explicitly flags language or locale constraints when a skill forces a specific language without user choice.
No suspicious patterns detected.