Security audit
Security checks for vulnerabilities and agentic risk
This lottery-analysis skill is mostly local data tooling, but it includes unsafe installation guidance and inconsistent disclosure about network fetching and betting-adjacent output.
Review before installing. Use the local Python scripts only on CSV files you trust, avoid running the documented `curl | bash` installer unless you independently trust and verify it, and treat all generated lottery numbers/statistics as non-predictive reference material rather than betting advice.
SKILL.md:507Unverified Remote Installer Executed Directly Through Bash
scripts/lottery_report.py:134Stored HTML Injection Through Unescaped CSV Issue Numbers
The declared description presents a broad, feature-rich lottery analytics platform with charting, filtering, statistical analysis, betting calculators, and coverage of many Sports Lottery play types. The supplied code chunk, however, only performs historical data retrieval and CSV caching/export for four numeric lottery games. It fetches records from 500.com/500star or generates local sample data when offline, then writes CSV output and prints a preview. There is no implementation of trend charts, condition screening,杀号定胆,和值跨度分析,冷热号走势,遗漏分析,位置/大小/奇偶形态 analysis, or support for competitive sports betting/football/basketball games. This is a material description-behavior mismatch, with the code representing a narrower historical data ingestion utility rather than the declared comprehensive analysis tool.
The declared description presents a broad lottery analysis and query tool covering many lottery and sports-betting play types with analytical features such as走势图、历史查询、杀号定胆、遗漏分析、冷热走势、复式胆拖计算等. The supplied code does something materially different: it randomly synthesizes example CSV rows for a limited subset of lottery types. Its primary purpose is data generation, not analysis or querying. There is no evidence of charting, statistics, filtering, real historical database access, validation, or support for the declared sports-betting categories. This is a clear description-behavior mismatch.
The description claims a broad analytics and reference platform for many China Sports Lottery play types, with features like historical data lookup, charts, trend analysis, filtering, and multiple statistical analyses. The code instead is a narrow local script that computes combinatorial counts and expands selections into explicit bet rows for 大乐透、排列3、排列5, then optionally writes them to CSV. While '复式胆拖计算' / '复式投注计算' partially aligns with the script, that is only a small subset of the declared purpose. The primary purpose and supported scope are materially different from the description, so this is a clear mismatch.
The description substantially overstates the implemented functionality. The actual script is specifically a '走势图生成器' that loads CSV data and prints textual charts and simple statistics. Its implemented capabilities are limited to charting and summary analysis for four lottery categories, with no evidence of querying external/history sources, no betting calculators, no conditional筛选, no号码核验, and no support for sports betting or football/basketball/fu-cai play types mentioned in the description. While some declared items like trend charts, hot/cold analysis, sum/span, odd/even, and position analysis are represented, the overall declared purpose is materially broader than the actual behavior, so this is a mismatch.
The supplied code is narrowly focused on validating whether a user's chosen numbers match historical draw data from a CSV and reporting prize outcomes. Its functions parse draw CSVs, compare selected numbers to draw numbers, and output winning status/prize level for 大乐透、排列3、排列5、七星彩. This is materially different from the declared purpose of a broad lottery analytics platform with走势图、历史数据查询、条件筛选、冷热号/遗漏/和值跨度/概率/形态分析、复式胆拖计算, and support for sports betting/football/basketball pools. While one trigger ('号码核验') loosely overlaps with the code's checking behavior, the overall description does not accurately represent the actual code's primary purpose or supported scope.
The code substantially aligns with part of the description: it does provide lottery number analysis, filtering, simple statistics, and combination calculation for 大乐透、排列3、排列5、七星彩. However, the declared description is materially broader than the implementation. The script only supports four lottery types defined in CONFIG and contains no logic for 竞彩足球、竞彩篮球、传统足彩. It also lacks actual trend chart generation/visualization ('走势图'), remote or built-in historical query functionality, and broader all-game coverage implied by '全玩法'. Its CSV analysis is limited to reading a user-supplied local CSV and computing simple frequencies and omissions, which is narrower than comprehensive historical querying and chart analysis. Therefore the description overstates the skill's supported scope and triggers include unsupported domains, making this a mismatch.
The declared description presents a broad, full-featured lottery analytics suite spanning multiple lottery and sports betting categories, with charting, historical lookup, statistics, trend analysis, and calculation tools. The supplied code only implements a narrow CLI-based杀号 filter for a user-provided number pool, supporting a handful of exclusion heuristics and optional reading of a local CSV file for simple overlap-based filtering. While杀号/条件筛选 is one small part of the declared functionality, the actual code does not substantiate the much broader stated purpose and coverage. Therefore the description materially overstates what this code chunk actually does.
The declared description presents a broad lottery analytics platform with many end-user analysis capabilities across all Sports Lottery play types. The supplied code does not implement those functions. Instead, it is a narrow data-processing script for merging CSV files, removing duplicates, sorting by date/issue, auto-detecting among a few lottery schemas, and exporting a consolidated CSV. While this may support downstream analysis workflows, the actual primary purpose is data consolidation, not analytics, charting, querying, or betting calculation. The code also omits several declared lottery categories entirely. Therefore the description materially overstates and misrepresents the implemented behavior.
The description promises a broad, multi-feature lottery analytics platform with data querying, charts, filtering, historical results, and support for many game categories including sports betting and traditional football pools. The supplied code only computes and prints fixed theoretical winning probabilities for four lottery games via a CLI. This is a materially narrower and different primary purpose than the declared description. There is no evidence of historical data access, chart generation, number trend analysis, conditional screening, omission statistics, or support for the additional declared game types. Therefore the declared description does not accurately represent the actual behavior.
The description presents a broad, full-featured lottery analytics tool spanning numerous lottery and sports betting products with querying, filtering, charting, and calculation functions. The supplied code chunk is much narrower: it parses a CSV file for one of four lottery types, computes simple aggregate statistics, and generates an HTML report. This is related to lottery analysis, so it is not unrelated functionality, but the declared scope and capabilities substantially overstate what this code actually does. Therefore this is a description-behavior mismatch.
The declared description presents a feature-rich lottery analytics tool covering trend charts, historical data lookup, number analysis, filtering, omission/hot-cold analysis, and betting calculations across many sports lottery play types. The supplied code instead is narrowly focused on validating CSV file structure and contents from the command line. It checks required columns, recognized lottery names, and expected counts/ranges of number fields for a few digital lottery categories. This is a materially different primary purpose from the declared analysis tool, and the described triggers are unrelated to the actual code behavior. Therefore this is a clear description-behavior mismatch.
L024 和 L894-L897 多次强调“ 不提供任何投注建议 ”，但 L239 明确写出“投注建议：单式5注，合计10元”，L296 还写有“后区搭配建议、综合号码池参考”。这属于文档内部对工具意图的直接自相矛盾：一边宣称仅供分析，一边指导投注数量和搭配。
Referenced artifact was not completely inspected
| `SKILL.md` | 是 | 技能入口，frontmatter + markdown 正文 |
Referenced artifact was not completely inspected
| `SKILL.md` | 是 | 技能入口，frontmatter + markdown 正文 |
Referenced artifact was not completely inspected
| `SKILL.md` | 是 | 技能入口，frontmatter + markdown 正文 |
The documentation instructs users to execute a remote script directly via 'curl ... | bash'. This is dangerous because any compromise of the remote host, TLS termination, distribution path, or served script results in immediate arbitrary command execution on the user's machine with the user's privileges.
curl -fsSL https://skillhub.cn/install/install.sh | bash
验证安装：
The shell-pipeline pattern chains network retrieval directly into execution, removing any opportunity for integrity verification or human review. In the context of a skill document that may be followed by users or agents, this can transform a documentation snippet into a high-risk execution vector.
curl -fsSL https://skillhub.cn/install/install.sh | bash
验证安装：
The skill advertises and exemplifies capabilities that read files, write files, and access the network, but it does not declare any explicit tool/permission scope. In a skill ecosystem, missing scope boundaries increases the chance that a host agent grants broader capabilities than intended, making later prompt or workflow abuse more damaging.
The manifest-style trigger list contains short generic phrases such as "竞彩分析", "走势图分析", "概率数据", and "位置分析" alongside more specific lottery terms. Several of these are broad enough to overlap with ordinary analytical requests, and the document does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
L394 明确写明“本工具不内置实时抓取功能，依赖用户提供或预先加载的开奖数据”，但 L274、L480、L676-L677 又把 fetch_data.py 描述为“在线拉取历史数据（三源自动降级到本地生成）”并给出调用示例。这不是实现细节差异，而是对技能是否具备联网取数能力的直接语义冲突，会误导用户对数据来源和行为边界的理解。
免责声明 L895 明确表示任何方法“均无法预测”，但 L861 的参数枚举把模式之一写成 predict。即使只是内部参数命名，这也会向使用者传达技能具有预测模式的含义，与前文反复强调的非预测定位形成直接冲突。
This Python file contains user-facing natural-language strings entirely in Chinese, including the module description and argparse help text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
This code file contains user-facing natural language strings and argument choices entirely in Chinese, including the module description and command-line interface text. Because the skill does not offer a language/locale option or document that it is intentionally limited to Chinese users, it violates the policy against forcing a specific language without user opt-in.
This code file contains user-facing natural-language strings and documentation exclusively in Chinese, starting with the module docstring and continuing through CLI descriptions and output. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
The argparse description, argument help, and all printed success/error messages are presented only in Chinese. Because these are direct user-facing interactions and no language selection mechanism or justification is provided, they violate the language/locale policy for natural-language content.