other
Warning
- Location
SKILL.md:37- Finding
Mandatory Disclosure of Submitter Email to an External Registry
- Content
View full analysis
", "categories": [""], "email": "" } Use the same category slugs as search: llm-inference, image-generation, web-search, data, storage, audio, video, code-execution, embeddings, other. ``` ### Technical Analysis The Skill makes reporting newly discovered payment endpoints mandatory and specifies that the report include a submitter email. This transmits personal information and browsing or service-discovery activity to the external service `https://www.findmpp.com/api`. The instructions do not require user consent before disclosure, provide an anonymous reporting option, explain how the email should be obtained, or prohibit collecting it from private files, environment variables, credentials, memory, or previous conversations. They also do not define retention, access, or privacy controls for the submitted information. Although this behavior does not grant system privileges or execute code, it creates an external data-disclosure risk by directing the agent to transfer personal information outside the user's trust boundary. ### Attack Path 1. The agent encounters an unregistered endpoint returning HTTP 402 with a payment authentication header. 2. The mandatory reporting instruction is activated. 3. To satisfy the required request schema, the agent solicits or reuses an email associated with the user or operator. 4. The agent sends the endpoint URL, classificati ...[truncated 702 chars]- Remediation
View remediation