算命老师傅

• Outcome: Review
• Latest audit: Aug 29, 2026 · 12:10 PM UTC
• Version: 4.0.2

Overview

The skill does not show theft or destructive behavior, but it needs review because it auto-invokes broadly, runs local scripts, and is designed to give highly certain guidance in sensitive areas like health, legal, relationships, and money.

Review before installing. Use it only for entertainment or cultural divination, not for medical, legal, financial, or major relationship decisions. Install only in an environment where running bundled Python/Node scripts is acceptable, and be aware that some advertised self-contained functionality failed inspection because required Node dependencies were missing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tainted flow: 'NODE' from os.environ.get (line 10, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

process.stdout.write(JSON.stringify(result));
'''

result = subprocess.run([NODE, '-e', script, str(LUNAR), json.dumps(SAMPLES, ensure_ascii=False)],
                        capture_output=True, text=True, encoding='utf-8', errors='replace')
if result.returncode:
    raise SystemExit(result.stderr or 'bundled calendar audit failed')

• Confidence: 97% confidence
• Finding: The script allows the NODE environment variable to control which executable is launched, and that value flows directly into subprocess.run without validation. Anyone who can influence the environment for this script can cause arbitrary code execution by pointing NODE to a malicious binary or script wrapper, which is especially risky because this file is an operational helper that may be run in developer or CI environments.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructions explicitly direct the agent to read local files, write response artifacts, and invoke shell, Node, and Python scripts, yet the metadata declares no permissions. That mismatch is dangerous because it hides the skill's true execution surface from reviewers and can enable unauthorized file access or command execution if the runtime honors the embedded instructions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The renderer interpolates values from chart.json and analysis.json directly into HTML using string replacement, with no context-aware escaping or sanitization. If any upstream data is attacker-controlled or LLM-generated with embedded HTML/JavaScript, the produced report can contain active script or dangerous markup, leading to stored/self-XSS when the HTML is opened or hosted.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file explicitly warns that `mingGongIndex/shenGongIndex` are not `gongs` array indices, but the later instruction tells the reader to use `ziwei.gongs[mingGongIndex]` to read 命宫. This contradiction can reliably cause the agent to read the wrong palace data, producing incorrect downstream interpretations and unsafe hallucinated certainty in user-facing fortune-telling outputs.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script documentation advertises lunar-calendar support, but the implementation does not perform any lunar-to-solar conversion and instead proceeds as if the provided date were already solar. In a fortune-telling skill, date accuracy is the core input to all downstream calculations, so this mismatch can systematically produce incorrect charts and misleading guidance while appearing authoritative.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The in-code comment explicitly states that lunar input is simplistically treated as solar, directly contradicting the advertised feature set. This is dangerous because users or higher-level agents may trust the flag and generate materially wrong outputs for birth-date-dependent analysis without any visible failure or warning.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Selecting an external runtime from an environment variable introduces an execution boundary where untrusted configuration can change what program actually runs. Even though the script's purpose is just calendar auditing for the divination engine, that context does not justify arbitrary runtime selection, so the mismatch makes the behavior more suspicious rather than less dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script executes an external Python interpreter chosen in part from the environment variable PYTHON, then falls back to PATH-resolved commands such as 'python' and 'py'. This creates a command-execution trust boundary: if an attacker can influence environment variables or PATH in the agent/runtime context, they can cause arbitrary code to run instead of the intended bridge, which is especially risky because the tool already processes user-supplied input and writes files.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The renderer concatenates multiple untrusted fields from `duanju_report` directly into HTML, including values such as `判断要点`, `遁格`, `宫位`, `组合`, `格局名`, `问题`, `门象意`, `星象意`, `神象意`, `格局提示`, `状态`, and `综合结论`, with only newline replacement in one branch. If any upstream input can influence these fields, an attacker can inject arbitrary HTML or script into the generated report, leading to stored/local XSS when the output file is opened in a browser.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes broad everyday terms such as 算命, 看命, 问事, 吉凶, and especially generic phrases that may appear in ordinary conversation, increasing the chance of accidental activation. Because this skill then instructs the agent to follow a complex workflow with file reads and script execution, an unintended trigger expands risk beyond mere UX annoyance into unplanned capability use.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Enabling implicit invocation without any trigger scoping or contextual constraints can cause the fortune-telling skill to activate in conversations where the user did not clearly request it. That increases the chance of unsolicited spiritually framed advice, misrouting of general queries, and prompt-steering side effects from broad keyword matching in unrelated contexts.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The skill is written to operate exclusively in Chinese and prescribes a fixed Chinese interaction style without checking the user's language preference. In practice, this can cause misunderstanding of sensitive fortune-telling guidance, weaken informed consent, and make users unable to recognize limitations or correct misinterpretations.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The document is entirely written as mandatory Chinese-only operational guidance and does not provide any user language selection, fallback, or documented business need that constrains the skill to Chinese. This can cause users to receive inaccessible or misleading service behavior, especially for consent-sensitive or high-stakes guidance, because the system may proceed in a language the user does not understand well.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file strongly constrains the assistant to speak in Chinese and maintain a fixed persona, without indicating any user-language fallback or documented locale requirement. This can degrade accessibility and cause the skill to ignore user language preferences, which is a legitimate quality and policy weakness, though it is not a direct code-execution or data-exfiltration issue.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: These lines require highly confident, concrete fortune-telling outputs such as exact timing and outcomes, while explicitly disallowing uncertainty language. In a divination skill covering relationships, career, and finances, this can unduly influence users' real-world decisions without any warning that the content is entertainment or non-factual guidance.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Although these lines ban some especially harmful statements, the file still covers health, lifespan, divorce, and investment-adjacent topics without a visible safety warning or escalation policy. Users may still receive authoritative-seeming predictions in sensitive areas, especially because the broader document emphasizes decisive, unhedged pronouncements.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The script writes to a caller-controlled output path with no checks for overwrite, path restrictions, or user confirmation. In an agent or automated environment, this can clobber existing files or write results to unintended locations if an attacker can influence the --output argument.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/qimen.cjs:81