紫微斗数 (北派飞星)

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This skill is a mostly local Chinese astrology charting helper; it asks for personal birth details and has some overbroad or incomplete documentation, but I found no hidden persistence, credential access, exfiltration, or destructive behavior.

Install only if you are comfortable providing exact birth details for astrology-style analysis. Prefer local text output unless you explicitly choose document or screenshot sharing, and treat health, finance, relationship, and life advice as entertainment rather than a decision-making basis.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full Zi Wei Dou Shu charting-and-interpretation capability, including specific computational features and use of an external library. The supplied code chunk is limited to interpreting fields that are already present on an input chart object. It contains static meaning dictionaries and simple heuristics for personality, cause palace, decade range, current year stem focus, and a few keyword-based question responses. There is no evidence of solar time correction, natal chart construction, palace derivation, four-transformation/flying-star calculations, or iztro integration. The primary purpose is related but materially narrower than declared, so this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

node scripts/calculate.js --birth="1990-05-15 14:30" --location="北京市朝阳区" --gender="男"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

node scripts/calculate.js --birth="1990-05-15 14:30" --location="北京市朝阳区" --gender="男"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

| `scripts/interpret.js` | 北派解盘逻辑 |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description lists broad triggers such as “排盘”, “紫微”, and “算运势”, which can match common user phrasing outside a clearly constrained invocation context. The file does not provide exclusion conditions or tighter trigger scope, increasing the risk of unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks for highly sensitive personal data including birth date/time, birthplace, and gender, which can enable profiling and re-identification, yet it provides no privacy notice, minimization guidance, retention limits, or consent language. In this context, the risk is elevated because birthplace plus exact birth timestamp is unusually identifying and not obviously safe to collect without disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that it may use external services for location lookup and document/image generation, which can transmit sensitive birth and location data to third parties without informing the user. This is dangerous because the data involved is personal and potentially identifying, and downstream processors may log or retain it outside the user's expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Examples like “算算我的运势” and “我的命盘怎么样” are broad natural requests that could refer to many kinds of astrology or fortune-telling, not specifically this skill. Because no negative examples or activation boundaries are given, these examples create ambiguous invocation conditions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file explicitly directs different interpretive treatment based on gender ('男命' vs '女命') without indicating user consent, configurability, or a documented rationale. In a fortune-telling or personal guidance skill, this can produce biased outputs, reinforce stereotypes, and lead to unequal advice for similarly situated users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script forces the locale parameter to 'zh-CN' in both chart-calculation paths, which is a natural-language locale constraint applied to all users. There is no option for users to choose another language or any documented justification that this skill is intentionally limited to a China-specific locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script explicitly formats the generated report timestamp with the 'zh-CN' locale and the rest of the user-facing output is hard-coded in Chinese. Under the policy provided, forcing a specific language/locale without offering user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s user-facing descriptions, analyses, advice strings, and CLI output labels are all fixed in Chinese. This forces a specific language/locale without any opt-in or alternative, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The package description is written only in Chinese and presents the skill as a Chinese-language skill without indicating any user language choice or explicit region-specific justification. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency uses a caret range (^2.3.0), which allows automatic installation of newer compatible versions. This increases supply-chain risk because a compromised or vulnerable upstream release could be pulled in without explicit review, especially relevant here because the skill relies on a third-party library for core calculation logic.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"format": "node scripts/format.js"
  },
  "dependencies": {
    "iztro": "^2.3.0"
  },
  "keywords": [
    "ziwei",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file is entirely presented in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, a fixed language without opt-in or justification can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file presents all instructional/reference content in a single language, which can be a natural-language policy concern when no user opt-in or locale justification is provided. The policy specifically calls for flagging skills that force a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains user-facing instructional content only in Chinese, and there is no indication that users may choose another language or that the language restriction is a documented regional requirement. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This JavaScript file contains only Chinese-language comments and a hard-coded list of Chinese provinces/cities, which indicates a locale-specific behavior. Under the policy rule, forcing a specific language or locale without opt-in or documented justification can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.