Bazi

• Analyzed: May 1, 2026, 7:36 AM
• Findings: 1
• Version: 1.0.1
• Hash: c9c110481e9d3aa46e432ceca2c2a60776ce93ddd9a7a7217a37066638f1d99c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides Bazi (Chinese fortune telling) analysis and collects extensive PII, including full names, former names, birth dates, times, and locations. It instructs the agent to transmit birth data to an external API (cn.apihz.cn) using 'curl' and includes aggressive prompt instructions in SKILL.md to trigger the skill even when not explicitly requested. While these behaviors align with the stated purpose, the combination of high-sensitivity data collection, external network calls, and agent-steering instructions represents a significant privacy and security risk.