other
- Location
SKILL.md:125- Finding
Unnecessary Collection of Personally Identifying and Biographical Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 125-138, 174-185, and 193-200
Vulnerability Type: Excessive Personal Data Collection
Risk Level: MediumEvidence
The Skill requires the user's name and former-name history:
markdown ### Step 1：收集姓名 直接询问用户姓名： > "请告诉我您的姓名。" （直接文字回复，不使用选项框） ### Step 2：收集曾用名 > "请问您有曾用名吗？" - 没有曾用名 → 跳过，进入 Step 3 - 有曾用名 → 收集曾用名内容，然后询问改名的大致时间（年份即可）。如果用户忘了，标记为"未知" - 不太清楚 → 跳过，进入 Step 3It also requests birthplace and life/death status:
markdown ### Step 7：收集出生地 > "请告诉我您的出生省份和城市（例如：辽宁省丹东市）。" 出生地用于真太阳时校正参考。如果用户提供的出生时间与时辰对应有偏差，可提醒用户可能存在真太阳时的影响。 ### Step 8：确认在世状态 > "请问要分析的人目前是否在世？" - 在世 → 自动获取当前日期，作为分析的"当前时间" - 已故 → 收集去世的年份，分析只推算到该年为止The confirmation step repeats these details in the conversation:
markdown 📋 信息确认： - 姓名：XXX（曾用名：XXX，改名时间：XXXX年/未知/无） - 阳历生日：XXXX年XX月XX日（或：未知） - 农历生日：XXXX年XX月XX日（或：未知） - 出生时辰：X时（或：未知） - 性别：男/女 - 出生地：XX省XX市 - 当前日期：XXXX年XX月XX日 - 在世状态：在世/已故（XXXX年去世）Technical Analysis
The executable calculator in
tools/bazi_pan.pyuses a date, time, and optional gender. It does not accept or process names, former names, rename dates, birthplace, or life/death status. Although the documentation says birthplace can support solar-time correction, the reviewed implementation contains no such correction.Consequently, the Skill collects personally identifying and sensitive biographical information beyond what its implemented calculation requires. Repeating these values in the confirmation summary further increases their exposure in Agent context and conversation logs.
This is a data-minimization and privacy issue rather than evidence of malicious exfiltration. The audit found no network transmission, local persistence, credential access, privilege escalation, or hidden payload associated with the collected data.
Attack Path
...[truncated 1233 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove mandatory collection of the user's name, former names, rename history, and life/death status from the core chart-calculation workflow.
- Limit required inputs to the values consumed by the implementation: birth date, birth time, and gender.
- Make birthplace optional and request it only if a documented solar-time correction is actually implemented.
- Before collecting any optional sensitive field, explain its exact purpose, retention implications, and whether omitting it affects the result.
- Obtain explicit user consent for optional personal-data processing.
- Do not repeat unnecessary personal information in the confirmation summary. Mask or omit identity fields whenever possible.
- Document data-minimization and retention expectations, including that personal details should not be written to persistent memory or external storage.
- Add tests ensuring that the normal workflow completes without collecting identity or unrelated biographical information.