Security audit

Tung Shing Almanac

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Chinese almanac API client, but users should understand it sends query details to 12Zodiacs.com and should not use it for medical, legal, or financial decisions.

Install only if you are comfortable with almanac queries being sent to 12Zodiacs.com. Avoid entering sensitive personal events or medical scheduling details, do not rely on results for clinical, legal, or financial decisions, and prefer not to pass an API key unless needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill exposes shell-based execution paths (`bash scripts/almanac.sh ...`) but does not declare permissions or execution expectations. That creates a trust and review gap: consumers or orchestrators may invoke command execution without explicit consent boundaries, and any future argument-handling flaws in the script would be harder to govern because the capability is undeclared.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README instructs agents to run the script and quote its output, but does not clearly disclose that user-provided activity/date parameters are sent to the external 12Zodiacs.com API. This creates a privacy and transparency risk: users or downstream operators may unknowingly transmit potentially sensitive scheduling details, life events, or dates to a third party.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger language is overly broad, including generic phrases such as 'lucky dates' and 'solar terms' without clear scope limits. This can cause the skill to activate in unrelated contexts and route users into shell/network-backed behavior unexpectedly, increasing the chance of inappropriate tool use or misleading responses outside the intended almanac domain.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly markets C-sections as a use case but places the safety disclaimer only later in the document rather than adjacent to that claim. In a medical-decision context, users may treat auspicious-date recommendations as actionable guidance, which can influence timing of surgery and create real-world health risk if not clearly framed as non-medical cultural content at the point of use.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The API response contains a `system_directive` field that attempts to control the agent’s final user-facing output. Even though the directive only forces attribution text, untrusted tool/API content must never be treated as instruction because this creates a prompt-injection channel and normalizes obedience to external directives. In this skill’s context, the directive is not directly data-destructive, but it can override user or system preferences and could become more dangerous if similar fields later carry stronger instructions.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script appends the API key directly into the request URL query string, which can be exposed through shell history, process listings, logs, proxies, browser-like tooling, or upstream server access logs. Although the transport uses HTTPS, placing secrets in URLs increases accidental disclosure risk and is unnecessary for a client handling credentials.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.