老师傅算命测事

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 12:12 PM UTC
• Version: 4.4.1

Overview

The skill’s local divination workflow includes clear consent and storage controls, though saved records require manual cleanup and readings have accuracy limitations.

Use the documented session manager and review the actual save location before sharing personal details. The default 24 hours limits continued use; files remain until you approve cleanup, and chat records or backups are outside that cleanup. Treat readings as traditional interpretation, not a basis for consequential decisions. Prefer the default local event-time mode because optional Beijing mode has an inconsistency. Review was static, and dependency provenance and predictive accuracy were not independently established.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (46)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The core divination behavior matches the description, and local subprocess execution and temporary files are supporting implementation details. However, main() writes directly to --output, defaulting to fusion.json, with no 24-hour validity or retention enforcement, cleanup-preview mechanism, or confirmation step. It reports the output path only after writing. TemporaryDirectory cleans up intermediate chart files, not the final consultation record. These are material differences from the advertised privacy lifecycle. Other components might provide those safeguards, but they are not established by the supplied chunk. No network transfer or unrelated capability is visible.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

在明确测算意图和保存同意后严格按两步走，不提前排盘；运行时由 `liuyao_qimen_fusion.py` 自动调用包内 `liuyao.cjs`、`qimen.cjs` 与 `qimen_core/`，不得改回外部绝对路径。

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

在明确测算意图和保存同意后严格按两步走，不提前排盘；运行时由 `liuyao_qimen_fusion.py` 自动调用包内 `liuyao.cjs`、`qimen.cjs` 与 `qimen_core/`，不得改回外部绝对路径。

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

在明确测算意图和保存同意后严格按两步走，不提前排盘；运行时由 `liuyao_qimen_fusion.py` 自动调用包内 `liuyao.cjs`、`qimen.cjs` 与 `qimen_core/`，不得改回外部绝对路径。

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md

`render.cjs`、`validate-analysis.cjs` 与旧海报只保留作内部回归审计。它们会暴露推断结构，不得生成、展示或交付给用户。用户要求可分享内容时，提供经过 `validate-consultation.cjs` 校验的详解会谈札记。

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable artifact remains available under the skill install path but its content is outside analyzer coverage.

Content

No source excerpt is available for this finding.

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/diagram-assets/glyphs.json (reported line 1)May include surrounding context.

json

g+QpkTzkHJL5KkaMf7HJQ2P9vYiBLfzmUfwdP1c20GBO4QuVMIdr/2pJZhDF/AOvvI7sM3AbSfosTxvUlUbsdKN/8T4Dzn87kIqyJ07pw+V0/EEvnPdj5K5GaNM9T8PpXN3nmOVC76T9ImexjSPD9EoNKswI5J3DpVQrvOfQVHoOVwFx3E8YphTVigOx1WLTKBrbufIuaAvoZtJ6Aww4kfocZos4QyJ6KqlUxqGX7K7TU83FXowe/BdjAa5JtSLVAIJBZhqK9AD3l3VqQrgtq5sSCvXJJjEEKFAXPIRVPBZDph6LfCUnrl/1tPsLQKJgDFjkH4vaBWKvAwquBLDUU/UJQvXeXZBuxwEU1LoIFT4IbC8LvQOxuYPuZAxidb9HaYI+A1rb7i6HEf/NPsPYjfBB+DJi31ZynE0vwexgwo1f79yB5phPedFiC5MlYQqmPaTFY3SMHhBD7Abj2VxyE+y2TgOqWobSTOFbC9IcQk2umf4hGFwq+BNL9hrj2NxO2wk7VN8KOlWEUjIJRMEgAALul6q0=","所":"eNpjYBgFo2AU0AsIJTMToUq+4ao8FmEWz8Xf/ncS0MtsVnni////x1nQxGVT1nz4DwIhuPXyWRZs+vgfApDsYdFLmHL1Pwx81sSik9MornPrw/9I4JUcSJzdOG3GqR/I4teqZdA1e66//fc/Cvi2wocV6Jy553+hCP+70GWExfJmFEW/jrQ4c4LFpZGF/16fGyGK3dsw/f8ebutJMueCi8P0/zg7J9uKG3ewgfTf704w40ETB+tfnKDPSiDKQPrnYxEH6zcmnFxG9f///+Y0CphBqn40sH+o6UcKP3eq6scCFo8k/bbcEKAG4iiBmexE6pcFaTFCTsziWMO/BYd+FZAWDcL6O3Ho1wFpkSWsvxc1/9yC6TcFaREmrH8ijvRrC2JxENY/DYd+V1CxzUBY/ywc+v1AtRUR+hcBZaqwiKcAxZ8RoX8rUCYTi3g9UPwkEf

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable artifact remains available under the skill install path but its content is outside analyzer coverage.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable artifact remains available under the skill install path but its content is outside analyzer coverage.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable artifact remains available under the skill install path but its content is outside analyzer coverage.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-release.py (reported line 10)May include surrounding context.

python

FILES=['SKILL.md','README.md','PRODUCT-COPY.md','CHANGELOG.md','LICENSE','NOTICE','skill-card.md','_meta.json','VOICE-SAMPLES.md']
TREES=['agents','references','scripts','engine']
BLOCK_PARTS={'.git','.clawhub','__pycache__','tests','_local'}
BLOCK_NAMES={'state.json','profile.json','auth.json','.env','fusion.json','chart.json','response.txt','package-lock.json','diagram.png','attachment.md','fallback.txt','manifest.json'}
def allowed(rel):
 return not (set(rel.parts)&BLOCK_PARTS or rel.name in BLOCK_NAMES or rel.suffix in ('.pyc','.pyo','.log','.tmp','.bak') or rel.name.startswith(('test_','test-')))
def build(out):

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/session_store.py (reported line 49)May include surrounding context.

python

def _powershell(script,paths):
    executable=Path(os.environ.get('SystemRoot',r'C:\Windows'))/'System32/WindowsPowerShell/v1.0/powershell.exe'
    env=dict(os.environ);env['LAOSHIFU_ACL_PATHS']=json.dumps([str(p) for p in paths])
    command=base64.b64encode(script.encode('utf-16-le')).decode()
    p=subprocess.run([str(executable),'-NoProfile','-NonInteractive','-EncodedCommand',command],env=env,capture_output=True,text=True,encoding='utf-8',timeout=30,shell=False)
    if p.returncode!=0:raise SessionError('无法设置或验证当前用户私有权限')

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/session_store.py (reported line 235)May include surrounding context.

python

if output.exists() or output.is_symlink():raise SessionError('本轮已有盘面，追问请沿用原盘，不覆盖重起')
        script=SCRIPTS/('chart_bazi_ziwei.py' if kind=='birth' else 'liuyao_qimen_fusion.py')
        old=os.umask(0o077) if os.name!='nt' else None
        try:p=subprocess.run([sys.executable,str(script),*arguments,'--output='+str(output)],cwd=session,capture_output=True,text=True,encoding='utf-8',timeout=120,shell=False)
        finally:
            if old is not None:os.umask(old)
        if p.returncode!=0:raise SessionError('本次排盘未成功；保留私有目录核对，不重新起卦或发起付款')

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx tsx'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx tsx'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx tsx'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx tsx'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx tsx'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx tsx'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Report rendering labels 调候 conclusions as highly confident regardless of available evidence.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The renderer unconditionally assigns “高” (high) to the 调候 confidence field, even when the associated conclusions are absent and rendered as placeholders. If the template displays this field, a generated report misrepresents uncertainty and can encourage undue reliance on personal predictions; this is a report-integrity issue rather than a code-execution vulnerability.

Content

No source excerpt is available for this finding.

The documented true-solar-time option has no effect on chart calculations.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The documented trueSolarTime and longitude arguments are never used in calculations, so requesting a correction silently produces an uncorrected chart. This is an output-integrity defect rather than a code-execution vulnerability, and the explicitly requested divination context limits its security impact.

Content

No source excerpt is available for this finding.

Generated evidence presents unsupported life predictions rather than explaining their basis and uncertainty.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The generator presents categorical wealth and relationship predictions as evidence, including high-strength claims without a justified basis or uncertainty. Although traditional divination is explicitly requested, this framing can encourage misplaced reliance in consequential financial or personal decisions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/chart_bazi_ziwei.py (reported line 89)May include surrounding context.

python

const v=JSON.parse(process.argv[2]);
const s=Lunar.fromYmdHms(v.y,v.leap?-v.m:v.m,v.d,v.h,v.min,0).getSolar();
process.stdout.write(JSON.stringify({year:s.getYear(),month:s.getMonth(),day:s.getDay()}));"""
    r = subprocess.run([_node_command(), '-e', script, module,
                        json.dumps({'y':args.year,'m':args.month,'d':args.day,'h':args.hour,'min':args.minute,'leap':leap})],
                       capture_output=True, text=True, encoding='utf-8', timeout=30)
    if r.returncode != 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/chart_bazi_ziwei.py (reported line 120)May include surrounding context.

python

f'--year={effective_time.year}', f'--month={effective_time.month}', f'--day={effective_time.day}',
           f'--hour={effective_time.hour}', f'--minute={effective_time.minute}', f'--gender={args.gender}',
           f'--timeZone={engine_time_zone}']
    r = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', errors='strict', timeout=60)
    if r.returncode != 0:
        raise RuntimeError(f"run-chart.js 失败: {r.stderr[:500]}")
    result = json.loads(r.stdout)