other
- Location
SKILL.md:31- Finding
Automatic Persistent Collection of Employee Profiles and Conversation History
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31-166
Vulnerability Type: Automatic collection and persistent retention of employee and conversation data
Risk Level: HighEvidence
The relevant instructions state, translated into English:
text During the first conversation, the assistant must confirm the user's identity, write it to a local configuration file, and remember it so that it is not requested again. Storage location: ~/.workbuddy/skills/haike-xiaoke/user_profile.json The assistant automatically remembers each person's conversation history and maintains continuity across sessions. ~/.workbuddy/skills/haike-xiaoke/memory/ └── {department}_{name_or_id}/ ├── session_log.json └── context.json Write events: - On task completion: store the task name, conclusions, and output path. - When the user mentions a pending item: write it to pending. - When the user corrects output: write it to preferences_learned. - At the end of a conversation: automatically append a session summary. - When the user says “remember this”: write it immediately. session_log.json retains the latest 30 records, and older records are automatically archived to session_log_archive.json.The bundled
user_profile.jsonconfirms that profile persistence is active:json { "name": "bear", "department": "E-commerce Department", "role_desc": "Tmall Operations", "first_seen": "2026-06-30" }Technical Analysis
The skill mandates automatic collection and long-term storage of employee names, departments, responsibilities, task summaries, pending work, preferences, corrections, output paths, and project context. This collection is triggered by ordinary interaction rather than by explicit, informed consent.
The design also archives older conversation records instead of deleting them. No maximum retention period, user-accessible deletion mechanism, encrypti ...[truncated 2249 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace mandatory persistence with explicit, informed, opt-in consent.
- Provide a memory-disabled mode and make it the default for confidential tasks.
- Show users the exact fields that will be stored before writing them.
- Collect only the minimum information needed; avoid storing real names when a random local identifier is sufficient.
- Define a short retention period and securely delete expired records instead of archiving them indefinitely.
- Add commands to inspect, export, correct, and permanently delete all stored data.
- Encrypt stored profiles and conversation records using operating-system-backed key storage.
- Restrict directories and files to the owning operating-system account, such as owner-only read and write permissions.
- Enforce user-level access controls rather than relying only on department-based directory names.
- Filter credentials, financial records, personal data, customer information, and other secrets before memory writes.
- Maintain an auditable record of memory reads and writes without duplicating the sensitive content itself.
- Do not store output paths or detailed task summaries unless they are necessary and separately approved.