skills/jinchenma94/bazi-skill/bazi/Gen Agent Trust Hub

bazi

Fail

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: CRITICAL
Full Analysis
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill collects personal information such as full name, birth date, gender, and birth location. This data is used within the chat context for astrological calculation and analysis. No exfiltration mechanisms to external domains were identified.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided birth data. While it lacks explicit boundary markers for this untrusted input, the skill does not have access to sensitive tools (like network or file-write tools) that would enable exploitation via injection.
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: No external packages or remote scripts are downloaded or executed. The skill relies entirely on local reference tables stored as markdown files.
  • [DYNAMIC_CONTEXT_INJECTION]: The skill mentions using a system date command to get current time, but it does not use the dynamic exclamation-backtick syntax for execution at skill load time.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Aug 18, 2026, 03:10 AM
Security Audit — agent-trust-hub — bazi