Back to skill

Security audit

wuxing-daily

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a local Chinese astrology tool, but its daily reminder feature asks the agent to create a persistent cron task without enough consent and removal safeguards.

Install only if you want a Chinese-language astrology/almanac-style tool and are comfortable entering birth date and possibly birth hour. Avoid enabling the daily reminder unless you have reviewed the exact cron command, understand that it will keep running on a schedule, and know how to remove it later. Treat health, finance, and major life-decision suggestions as entertainment or cultural reference, not professional advice.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
描述与代码部分匹配:代码确实提供五行属性计算、八字排盘与命格相关分析。但声明中的重要功能“每日运势提醒”和“黄历宜忌”在代码中完全没有实现;代码也未体现任何面向日期的日运逻辑或黄历择日逻辑。此外,代码要求具体出生时辰,并对月份采用“假设输入的是农历月份”的简化处理,这与宽泛的“根据生日计算”存在一定偏差。因此整体存在实质性描述不符,但并非恶意或越权能力扩展。

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
声明描述的核心能力是命理分析与运势/黄历建议,但提供的代码只包含日期换算相关逻辑:农历数据表、公历转农历、农历转公历、年干支与生肖的基础计算,以及日期格式化输出。虽然年干支和生肖可作为命理系统的基础要素之一,但代码没有计算完整八字(年/月/日/时四柱)、没有五行映射、没有命格推断、没有运势算法,也没有宜忌内容生成。因此,实际代码与声明用途存在明显且实质性的功能不匹配。

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The README presents all user-facing instructions and examples exclusively in Chinese, which effectively forces a specific language for users. Under the policy criteria, locale or language constraints should either be optional for the user or clearly documented as justified for a region-specific tool.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The manifest says to use the skill whenever the user asks about 生辰八字, 五行属性, 命格分析, 每日运势提醒, or 黄历宜忌, but it does not define clear boundaries or exclusions. Several of these phrases are broad request types that could match ordinary conversational requests without specifying when this skill should or should not activate.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Birth date and especially birth time are sensitive personal data that can be used for profiling, identity correlation, or cultural/religious inference. Collecting this information without an explicit privacy notice, minimization guidance, or retention statement increases privacy risk and can normalize unnecessary disclosure.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill is presented as an analysis tool, but it also documents creation of persistent cron jobs. Persistence on a user's system is security-relevant because it creates ongoing execution beyond the immediate request, and users may not understand they are authorizing a scheduled task with repeated code execution.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The reminder setup is shown as a normal feature without prominently warning that it creates a persistent scheduled task on the user's system. Hidden or underexplained persistence reduces informed consent and can leave users with ongoing background execution they did not expect.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Cron-based scheduling is not necessary for basic fortune calculation and increases the attack surface by introducing persistence. If the command or path is modified, or if users do not realize the task remains installed, it can lead to unauthorized repeated execution and operational surprise.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The module docstring and all user-facing output are written in Chinese, and the skill provides no opt-in, language selection, or documentation that it is intentionally limited to a Chinese-speaking audience. This creates a natural-language policy issue because the skill forces a specific language by default.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The formatted report, labels, personality descriptions, and command-line help are all hard-coded in Chinese, with no mechanism for users to choose another language. For a general-purpose skill file, this is a language policy violation unless the locale limitation is clearly documented and justified.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This Python file contains user-facing natural-language strings exclusively in Chinese, including the title, descriptions, and final report output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This code file contains natural-language documentation entirely in Chinese, and the CLI output/messages are also fixed to Chinese. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale restriction is a natural-language policy violation.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The exception and printed output strings in this file are presented only in Chinese, and the script does not provide any mechanism for users to choose their preferred language. This creates a language/locale policy issue because the skill effectively forces one language without opt-in.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The file gives health and wellness suggestions tied to organs, emotions, diet, and exercise without any disclaimer that this is traditional belief content rather than medical advice. In a skill explicitly used for personal destiny, wellness, and daily guidance, users may reasonably rely on these recommendations for health decisions or delay appropriate medical care.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
This markdown file presents all instructions and reference material exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally region- or language-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low
Confidence
74% confidence
Finding
All user-facing content in the file is presented exclusively in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional and justified. This may violate a language/locale policy if the skill is expected to be generally usable without forcing a specific language.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown content forces a single language throughout without any user opt-in, alternative language option, or justification that the skill is region-specific.

Static analysis

No suspicious patterns detected.