cantian-bazi
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs astrological calculations locally without any network exfiltration or unauthorized file access. The scripts are focused on processing dates and coordinates for charting purposes.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute local scripts (e.g.,
node scripts/buildBaziFromSolar.ts) to perform its primary functions. These commands are legitimate and necessary for the skill's documented behavior.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles user-provided data such as birth times and location names via command-line arguments.\n - Ingestion points: Input data is ingested through CLI arguments in all scripts, including structured JSON in
queryFortuneRange.ts.\n - Boundary markers: Results are formatted as Markdown for the agent to relay to the user.\n
- Capability inventory: The skill's environment is restricted to computational scripts with no network or sensitive file system access.\n
- Sanitization: The skill employs strict validation, including regex patterns for ISO 8601 dates and lookups against a static dictionary of city coordinates, effectively neutralizing injection risks.
Audit Metadata