Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese divination charting skill with no evidence of hidden data access, persistence, or remote code execution, though some claims and high-stakes advice need caution.
Install only if you want a Chinese-language metaphysical charting tool. Treat health, financial, legal, travel, and feng shui outputs as cultural or entertainment reference, not professional advice; verify important decisions with qualified professionals.
该代码的主功能确实与奇门遁甲排盘高度相关，因此不是完全无关技能；但声明明显夸大了已实现能力。实际代码核心是“排盘引擎”，实现了拆补法、四盘排布及少量辅助判断（空亡、马星、六仪击刑）。然而声明中的多项关键能力——置润法、吉凶格大规模识别、天干克应库、按问题类型深度解盘、初学者指南——在提供的代码片段中均未出现。故描述不能准确代表实际行为，属于能力范围上的实质性不符，而非仅仅实现细节缺失。
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
node scripts/main.js
Referenced artifact was not completely inspected
| `scripts/engine.js` | 排盘核心引擎（节气、定局、四盘排列） |
Referenced artifact was not completely inspected
| `scripts/format.js` | 盘面格式化输出（九宫格、文本） |
The trigger terms are broad enough to match ordinary conversation about luck, timing, travel, or divination, which can cause unintended activation of the skill. In an agent environment, overbroad activation expands the skill's execution surface and may cause it to run in contexts where the user did not clearly request this specialized behavior.
This section provides disease-assessment and treatment-related guidance, including judging illness severity, organ involvement, whether a condition is treatable, and whether medicine is appropriate, but it does not warn users that the content is not medical advice. In skill context, this is more dangerous because the material is presented as a structured decision framework, which may cause users to substitute divination output for professional medical evaluation or delay necessary care.
This formatter’s natural-language strings, headings, labels, and comments indicate the skill produces Chinese-only output. The policy requires flagging language or locale constraints when they are enforced without user opt-in or a clearly documented region-specific justification.
This codebase embeds user-facing descriptions and output text exclusively in Chinese, beginning with the module description and continuing throughout the generated summary/detail/advice strings. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern unless the regional constraint is explicitly documented and justified.
This code hardcodes user-facing help, status, and formatted output in Chinese throughout the CLI. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale restriction is a natural-language policy violation.
The example phrases suggest possible activation scenarios but do not define strict invocation boundaries, confirmation requirements, or non-trigger cases. This ambiguity can lead to accidental or overly eager skill activation, especially because the examples overlap with casual requests a general assistant might answer without invoking an external skill.
This markdown file presents all instructional content in Chinese and does not indicate that users may choose another language. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern unless the locale constraint is explicitly documented and justified.
The entire document is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy category, content that effectively mandates a specific language without opt-in can be a natural-language policy violation.
This markdown file contains user-facing instructions entirely in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
The file is entirely written in Chinese and does not indicate that the skill is region-specific or that users can choose another language. Under SQP-3, forcing a specific language without user opt-in can violate language or locale policy unless the restriction is clearly documented and justified.
This JavaScript file is written and documented entirely in Chinese, and the only explicit user-facing error message (无效的日期格式) is also hard-coded in Chinese. Under the policy, forcing a specific language without offering a user choice can be a locale-policy violation unless the language constraint is clearly documented and justified.
This JavaScript file contains natural-language documentation entirely in Chinese, and the exported skill functionality appears to rely on Chinese domain terminology throughout. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no locale choice or justification is provided.
No suspicious patterns detected.