Security audit

Bazi

Security checks for vulnerabilities and agentic risk

Overview

This Bazi skill is mostly coherent, but it collects sensitive birth/profile details and sends birth-date data to an external API without a clear consent or privacy warning.

Review this skill before installing if you are uncomfortable sharing name, former name, birth date, birth time, gender, birthplace, or living/deceased status. Use it only when you intentionally want Bazi analysis, avoid providing private apihz credentials unless you understand URL logging risks, and prefer a project-scoped, pinned install over a global clone from a mutable branch.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:38
Finding: Sensitive Birth Data and API Credentials Exposed Through URL Query Parameters
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:21
Finding: Installation Instructions Clone a Mutable and Unpinned Skill Source
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill requests highly sensitive personal data including name, former names, date of birth, birth time, gender, and birthplace, then instructs the agent to send birth-date data to an external API. There is no explicit consent flow, privacy notice, minimization rule, or warning that user data will be transmitted to a third party, which creates a meaningful privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger instructions are intentionally expansive, including generic terms like “算命” and requiring activation even on casual mentions. That can cause the skill to engage and begin collecting sensitive personal data in contexts where the user did not clearly request it, increasing the risk of over-collection and unintended disclosure.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
bash
# 安装到当前项目（在 git 仓库根目录执行） mkdir -p .claude/skills git clone https://github.com/jinchenma94/bazi-skill .claude/skills/bazi # 或安装到全局（所有项目都能用）

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
bash
# 安装到当前项目（在 git 仓库根目录执行） mkdir -p .claude/skills git clone https://github.com/jinchenma94/bazi-skill .claude/skills/bazi # 或安装到全局（所有项目都能用）

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
bash
# 安装到当前项目(在 git 仓库根目录执行) mkdir -p .claude/skills git clone https://github.com/jinchenma94/bazi-skill .claude/skills/bazi # 或安装到全局(所有项目都能用)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes very broad everyday terms such as "算命" and similar generic phrases, and the metadata further states the skill should be used even when the user only casually mentions those terms. This can cause unintended invocation in unrelated conversations, leading the agent to collect sensitive personal data like birth date, time, gender, and birthplace when the user did not clearly intend to invoke the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This markdown file presents all instructions and content exclusively in Chinese, with no indication that the user can opt into this language or that the file is intentionally limited to a Chinese-only audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire skill file is written in Chinese and presents its reference content only in that language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the policy, a fixed language/locale without user opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file presents all headings and reference material exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative language option is provided. The content does not indicate that the skill is region-specific or that Chinese output is optional.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.