Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Chinese divination helper with a local deterministic calculator and no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Install only if you want a Chinese-language Xiao Liu Ren divination assistant. Treat any health, legal, financial, or dispute-related readings as cultural or reflective content, not professional advice, and verify important decisions with qualified experts.
Line L40 states that interpretations must use natural, conversational Chinese, which imposes a specific language requirement. This is a natural-language policy issue because the file does not offer the user any language choice or indicate that Chinese-only output is optional or justified by a region-specific constraint.
The display metadata and default prompt are Chinese-only, which may cause the agent to respond in Chinese even when the user has not requested that language. This is primarily a UX and consent issue, but it can also lead to misunderstanding of sensitive guidance or outputs if the user's preferred language differs.
The manifest uses a very broad default invocation phrase ('用小六壬为这件事起卦并解读') together with implicit invocation, which can cause the skill to activate on loosely related user requests. In a conversational system this increases the chance of unintended routing, especially when users mention divination-like concepts without explicitly consenting to use this skill.
The reference material gives health-related divination guidance such as predicting illness severity or recovery without any warning that it is not medical advice. In a fortune-telling skill, users may rely on these outputs to delay care or make unsafe health decisions, especially because the text presents outcomes in an authoritative, condition-specific way.
The reference includes legal-dispute guidance ('官司') that suggests likely outcomes without a disclaimer that it is not legal advice. Although lower risk than medical content, users could still overtrust the result and make poor decisions about disputes, claims, or whether to seek professional counsel.
The CLI description, help text, accepted hour/palace values, and output keys are all fixed in Chinese, including Beijing-specific time conventions and Chinese-labeled JSON fields. This imposes a specific language/locale on all users without any opt-in or alternative locale support, which matches the language/locale policy violation category.
No suspicious patterns detected.
