Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small Chinese I Ching helper that runs a local calculation script and does not show hidden, destructive, persistent, or credential-seeking behavior.
Install this only if you want a Chinese-language I Ching/Meihua divination helper. Be aware that results depend on the current time and that inputs may be normalized modulo 8; links point to an external reference site but the script itself does not contact it.
主要功能与声明大体相关，确实是在做梅花易数起卦并输出卦名、动爻和链接。但存在若干实质性偏差：第一，代码的动爻计算并不只依赖“上卦、下卦数字查六十四卦”，还额外使用了当前时间小时映射出的时序 order 参与计算，这会影响结果，属于未声明的重要行为。第二，声明的用法是“/gua <上卦数> <下卦数>”，像是聊天技能命令；而实际代码是独立 Python 脚本，支持命令行参数或交互输入，没有对应触发器实现。第三，交互输入函数允许 164 的整数，再通过取模归一到 18，和“上卦、下卦数字”通常对应八卦编号的直观含义不完全一致。综合看，描述与实际用途方向一致，但实现行为和接口方式存在足以构成不准确描述的差异。
The instruction explicitly requires the response to be written in '通俗中文', which imposes a specific language choice on all users. This is a natural-language policy concern because the file does not offer a language option or explain a justified region-specific constraint.
The module docstring and all user-facing prompts/messages are written exclusively in Chinese, which imposes a specific language on users without opt-in or alternative locale support. Under the natural-language policy rules, this is a language/locale constraint that should be user-selectable or explicitly justified as region-specific.
The entire markdown file is written only in Chinese and provides no indication of language choice or alternative locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
This manifest-style JSON file consists entirely of Chinese hexagram names and aliases as keys, which imposes a specific language/locale in the skill's natural-language interface surface. Because the file provides no opt-in, alternative locale support, or documented justification for the language restriction, it may violate the policy against forcing a specific language without user choice.
This markdown file presents all user-facing content in a single language and does not indicate that the language is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The skill manifest and usage text describe /gua <上卦数> <下卦数>, and the internal mapping only defines trigram numbers 1-8, but read_gua accepts integers from 1 to 64 and tells users that range is valid. This is not merely incomplete documentation: the prompt actively states a broader valid input range than the underlying documented concept of upper/lower trigrams implies, and the code then silently normalizes those values modulo 8.
No suspicious patterns detected.
