liki-fengshui
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with external endpoints at
https://liki.hkto perform version checks and retrieve JSON-RPC schemas during initialization. - [DATA_EXFILTRATION]: User-provided data, including birth year, gender, and specific home orientation details, is transmitted to the remote endpoint
https://liki.hk/jsonrpcto generate Feng Shui charts. Feedback is also sent tohttps://liki.hk/api/feedback. - [COMMAND_EXECUTION]: The skill logic includes a procedure to compare a local
VERSIONfile with a remote version and instructs the agent to prompt the user with update commands if a mismatch is found, which could lead to the execution of unverified shell commands. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data returned from the
liki.hkJSON-RPC service, which represents a potential injection surface. - Ingestion points: Data is ingested via the JSON-RPC responses from methods such as
bazhai.chart,xuankong.chart, andtime.now. - Boundary markers: The skill defines strict boundaries, instructing the LLM to only interpret "returned factors" and forbidding the manual modification or assembly of the
chart_digestreturned by the engine. - Capability inventory: The skill maintains network access to the
liki.hkdomain for RPC calls, versioning, and feedback. - Sanitization: The skill utilizes the
rpc.discovermethod to identify and adhere to the schema provided by the engine before processing data.
Audit Metadata