Security audit

命理大师

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a disclosed local astrology skill, but it needs Review because several input-handling bugs could expose or modify local JSON files or a browser-entered API key.

Review before installing on shared or multi-user machines. Do not store real birth, family, or relationship data unless you are comfortable with local plaintext files; use a separate limited LLM API key if you enable the browser feature. The publisher should fix userId path validation, owner-only profile permissions, and unsafe innerHTML rendering before this is treated as a low-risk install.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/profile.js:53
Finding: Path Traversal Enables File Access Outside the Profile Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: liuyao/index.html:1073
Finding: DOM-Based Cross-Site Scripting Through the Divination Question
Content: View full analysis
card.scrollIntoView({behavior:'smooth',block:'start'}),120); const info=getGuaInfo(yaoResults); const q=document.getElementById('questionInput').value.trim(); renderDiagram(info,q); document.getElementById('speechText').textContent= (q?`仙家所问「${q}」，`:'') +`六爻已落，上${info.upper.name}下${info.lower.name}，卦象已现。雪儿这便为仙家细细道来……`; callLLM(info,q); } function renderDiagram(info,q){ const lh=yao3=>yao3.map(y=>y ?`
` :`
` ).join(''); document.getElementById('guaDiagram').innerHTML=`

上卦

${lh([info.yao6[3],info.yao6[4],info.yao6[5]])}

${info.upper.sym}

${info.upper.name}·${info.upper.nature}

${info.upper.name}${info.lower.name===info.upper.name?'为'+info.upper.nature:''}卦
${q?`
「${q}」
`:''}

下卦

${lh([info.yao6[0],info.yao6[1],info.yao6[2]])}

${info.lower.sym}

${info.lower.name}·${info.lower.nature}

`; } ``` The same question also enters HTML fallback output: ```javascript out.innerHTML=offlineFallback(info,question); ``` ```javascrip ...[truncated 2011 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/profile.js:70
Finding: Sensitive Profile Files Are Created Without Explicit Owner-Only Permissions
Content: View full analysis
Remediation: View remediation

other

Note

Location: liuyao/index.html:10
Finding: Google Fonts Is Contacted by Default Despite the Declared Offline Network Policy
Content: View full analysis
``` ### Technical Analysis The HTML document actively establishes a connection to Google Fonts and loads a remote stylesheet whenever the page is opened. This contradicts the declarations in `SKILL.md` and `README.md` that Google Fonts is commented out or disabled by default. The request is not necessary for the core divination functionality because the documentation states that system fonts provide an offline alternative. It therefore exceeds the minimum network access needed for the default feature set. The request does not transmit stored profile files or the optional LLM API key. It does, however, disclose ordinary network metadata to a third party without the user first enabling an online feature. ### Attack Path 1. A user opens `liuyao/index.html` expecting default offline operation. 2. The browser processes the active `preconnect` and stylesheet elements. 3. The browser contacts Google infrastructure. 4. Google receives request metadata before the user enables or consents to the optional LLM feature. ### Impact Assessment The third party may receive: - The user's public IP address. - Request time and frequency. - Browser and transport metadata. - Potential referrer information, depending on browser and hosting behavior. This is a privacy and policy-compliance issue rather than code execution or credential exfiltration. It also makes the interface unsuitable for strictly offline or network-restricted deployments unless the links are removed. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (78)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
- "LLM API key for liuyao/index.html divination feature (scope it to a separate limited key, never reused)"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
- "LLM API key for liuyao/index.html divination feature (scope it to a separate limited key, never reused)"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.
md
- "LLM API key for liuyao/index.html divination feature (scope it to a separate limited key, never reused)"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.
md
- "LLM API key for liuyao/index.html divination feature (scope it to a separate limited key, never reused)"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 444)May include surrounding context.
md
- "LLM API key for liuyao/index.html divination feature (scope it to a separate limited key, never reused)"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 426)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 427)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 428)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 429)May include surrounding context.
md
- "view: node scripts/profile.js show <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.
md
- "disable push: node scripts/push-toggle.js off <userId>"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
# 示例：node scripts/bazi-analysis.js 丙寅己亥乙丑乙酉

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 372)May include surrounding context.
md
- `daily-push.js`：纯本地计算，生成运程文本后通过 `console.log()` 输出，由 OpenClaw cron 运行时负责投递给用户

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · liuyao/index.html (reported line 7)May include surrounding context.
html
<meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>雪儿解卦 · 六爻易经</title> <!-- Fonts: uses local system CJK calligraphy fonts (STKaiti/KaiTi) as fallback. To enable Google Fonts (Ma Shan Zheng / ZCOOL XiaoWei), uncomment the lines below. Note: uncommenting will cause external network requests to fonts.googleapis.com. <link rel="preconnect" href="https://fonts.googleapis.com">

Static analysis

No suspicious patterns detected.