People Investigation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:14 PM UTC
• Version: 1.0.0

Overview

This people-investigation skill tells agents to search private local archives and memory and compile sensitive personal dossiers, so it needs careful review before installation.

Install only if you are comfortable with a broad people-search workflow. Before use, require explicit consent and a lawful, non-harassing purpose; disable or remove instructions that search private local archives, messages, payments, call logs, and memory; avoid returning home addresses, personal contact details, children, unrelated relatives, or financial proxies unless strictly necessary and authorized.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:20
• Finding: Unauthorized Inspection of Private Local Data and Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-29` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```markdown ### Phase 1: Establish Identity Anchors Before searching externally, check internal data sources for any existing info: 1. **Google Contacts/Takeout** — `grep -ri "name" data/google-takeout/Takeout/Contacts/` 2. **Google Pay transactions** — `grep -i "name" data/google-takeout/Takeout/Google\ Pay/` 3. **Call history** — `grep -i "name\|phone" data/google-takeout/Takeout/Drive/calls-*.xml` 4. **Memory files** — `memory_search` for the person's name 5. **WhatsApp/SMS history** — check message archives if available Collect all **identity anchors**: full legal name, middle name/initial, DOB, phone numbers, email addresses, physical addresses, employers. These are critical for disambiguating common names. ``` ### Technical Analysis The Skill instructs the Agent to inspect Google Takeout data, payment transactions, call logs, persistent memory, and private message archives before using public sources. These repositories can contain highly sensitive information belonging both to the user and unrelated third parties. This behavior violates least privilege because the declared functionality is public-record and web-based people research. Access to private communications, financial records, and persistent Agent state is not necessary to perform a public-record lookup. The Skill does not require explicit consent, verify authorization to inspect each source, constrain searches to user-selected files, or minimize the information extracted. The later statement that the Skill should use only publicly available information conflicts directly with these instructions and does not provide an enforceable safeguard. ### Attack Path 1. A user or attacker asks the Agent to investigate a named person. 2. The Skill loads and directs the Agent to search local Google Takeout archiv ...[truncated 865 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all default instructions to inspect Google Takeout, payment records, call logs, private messages, and Agent memory. 2. Restrict the Skill to public and authoritative sources required by the user's specific request. 3. If private-source analysis is an intended optional feature: - Obtain explicit, informed consent for each data source. - Require the user to select the specific files or records to inspect. - Verify that the user is authorized to disclose the information. - Disable persistent-memory searches by default. - Extract only the minimum fields necessary for the stated purpose. 4. Prevent unrelated third-party data from being included in results. 5. Add an enforceable policy gate that blocks private-source access for general background-check requests. 6. Avoid retaining extracted identifiers after the active task ends. ]]>

other

Warning

• Location: SKILL.md:135
• Finding: Excessive Aggregation and Disclosure of Personal Information<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:135-177` **Additional Relevant Locations**: `SKILL.md:28-29`, `SKILL.md:179-201` **Vulnerability Type**: `other: Privacy-invasive personal-data aggregation` **Risk Level**: Medium ### Vulnerable Code ```markdown Collect all **identity anchors**: full legal name, middle name/initial, DOB, phone numbers, email addresses, physical addresses, employers. These are critical for disambiguating common names. ``` ```markdown ## Report Format Present findings in a structured dossier: ## [Full Name] — Investigation Report ### Identity - Full legal name, DOB, age - Phone numbers (with area code context) - Email addresses (work + personal) - Current address + previous addresses ### Career History - Current role + company + duration - Previous roles (reverse chronological) - Notable achievements, revenue figures, press mentions ### Property & Real Estate - Current property (address, purchase date, price, specs) - Property history (table format) - Mortgage/lien info if found ### Court & Legal Records - Federal: [results or "Clean — no records found"] - State: [results by county] - Traffic: [results or "Nothing indexed"] ### Corporate Affiliations - Active businesses (name, role, status) - Dissolved businesses - Officer/director positions ### Social Media & Web Presence - Active profiles with links - Notable posts or activity ### Family Connections - Spouse/partner - Children - Parents, siblings - Other relatives from aggregator data ### Financial Indicators - Property values (wealth proxy) - Political donations (FEC) - Philanthropy ``` ```markdown - **Address history → neighbor data:** Clustrmaps and Spokeo show neighbors, which can reveal family members ``` ### Technical Analysis The Skill directs the Agent to build a centralized dossier containing dates of birth, personal contact information, current and historical addresses, property and lien information, court records, social profiles, politi ...[truncated 1707 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the “find everything” model with purpose-limited collection. 2. Require a legitimate and consent-based purpose before processing sensitive personal information. 3. Refuse requests involving stalking, harassment, intimidation, doxxing, or covert monitoring. 4. Exclude exact residential addresses, personal phone numbers, private email addresses, children, neighbors, and unrelated relatives by default. 5. Report only the fields necessary to answer the user's narrowly stated question. 6. Prefer summaries over raw personal identifiers and redact unnecessary details. 7. Introduce a heightened review step before returning legal, financial, political, or family information. 8. Establish retention and deletion limits for generated dossiers and source data. 9. Clearly identify uncertain matches and avoid inferring relationships solely from shared addresses or aggregator data. ]]>

other

Warning

• Location: scripts/fec-lookup.sh:13
• Finding: Target Identifiers Disclosed to Multiple External Services Without Adequate Notice<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fec-lookup.sh:13-23` **Additional Relevant Locations**: `scripts/sunbiz-officer.sh:18-29`, `SKILL.md:32-134` **Vulnerability Type**: `other: Third-party privacy disclosure` **Risk Level**: Medium ### Vulnerable Code ```bash BASE="https://api.open.fec.gov/v1/schedules/schedule_a/" # FEC API key (demo key, rate-limited but functional) API_KEY="DEMO_KEY" PARAMS="contributor_name=${NAME// /+}&sort=-contribution_receipt_date&per_page=20&api_key=${API_KEY}" [ -n "$STATE" ] && PARAMS="${PARAMS}&contributor_state=${STATE}" URL="${BASE}?${PARAMS}" echo "Searching FEC contributions for: $NAME ${STATE:+(state: $STATE)}" echo "URL: $URL" echo "---" RESPONSE=$(curl -s "$URL") ``` ```bash URL="https://search.sunbiz.org/Inquiry/CorporationSearch/SearchByOfficerRA?SearchTerm=${LAST}+${FIRST}&SearchType=Officer" echo "URL: $URL" echo "" echo "Note: Sunbiz is JS-rendered. If web_fetch returns empty results," echo "use the browser tool (profile=openclaw) to navigate to:" echo " https://search.sunbiz.org/Inquiry/CorporationSearch/SearchByOfficerRA" echo "Then search for: $LAST $FIRST" echo "" # Attempt fetch (may not render JS) curl -sL "$URL" | grep -oP '(?<=<a href="/Inquiry/CorporationSearch/SearchResultDetail\?)[^"]+' | head -20 || echo "No results via curl (site may require JS rendering)" ``` ### Technical Analysis The scripts submit a target's name and, for FEC searches, optional state information to third-party services. The broader instructions direct the Agent to query numerous additional aggregators, court systems, property services, and social platforms. External network access is functionally necessary for public-record research, and the reviewed scripts do not transmit local credentials or execute downloaded code. However, the breadth of recipients is not minimized, and the Skill does not require notice or confirmation before sending target identifiers. Each provider can potentially log the qu ...[truncated 1246 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Inform the user which external service will receive each identifier before sending a request. 2. Obtain confirmation before querying commercial aggregators or services with significant tracking risk. 3. Prefer authoritative government sources and minimize the number of recipients. 4. Send only the minimum query fields required by each service. 5. Do not submit identifiers obtained from private local archives to external providers. 6. Avoid printing complete URLs containing personal identifiers or API parameters; emit a redacted summary instead. 7. Document provider privacy and retention considerations where known. 8. Provide a privacy-preserving mode that generates links locally without automatically making network requests. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/fec-lookup.sh:16
• Finding: Improper URL Encoding Permits Query-Parameter Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fec-lookup.sh:16-19` **Additional Relevant Location**: `scripts/sunbiz-officer.sh:18` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Low ### Vulnerable Code ```bash PARAMS="contributor_name=${NAME// /+}&sort=-contribution_receipt_date&per_page=20&api_key=${API_KEY}" [ -n "$STATE" ] && PARAMS="${PARAMS}&contributor_state=${STATE}" URL="${BASE}?${PARAMS}" ``` ```bash URL="https://search.sunbiz.org/Inquiry/CorporationSearch/SearchByOfficerRA?SearchTerm=${LAST}+${FIRST}&SearchType=Officer" ``` ### Technical Analysis User-controlled names and state values are inserted directly into URL query strings. Replacing spaces with plus signs is not complete URL encoding. Reserved characters such as `&`, `=`, `#`, `%`, and `?` can change parameter boundaries, introduce additional parameters, truncate a request, or otherwise alter its interpretation by the remote endpoint. The completed URL is passed to `curl` as a quoted argument, so the reviewed code does not demonstrate shell command injection. The issue is request and query manipulation rather than execution of arbitrary local commands. The Sunbiz script has the same weakness because parsed first and last names are interpolated without percent encoding. ### Attack Path 1. An attacker or untrusted caller supplies a crafted name or state containing URL delimiter characters. 2. The script performs only space replacement or no encoding. 3. The crafted delimiters are inserted unchanged into the request URL. 4. The remote server interprets part of the input as a separate query parameter, fragment, or malformed value. 5. The script returns incorrect or attacker-influenced search results, potentially causing misattribution. ### Impact Assessment The vulnerability can alter search semantics, produce malformed requests, bypass intended state filtering, or cause results to be associated with the wrong person. This undermines th ...[truncated 255 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use `curl --get --data-urlencode` for every user-controlled query parameter: ```bash curl --silent --get "$BASE" \ --data-urlencode "contributor_name=$NAME" \ --data-urlencode "sort=-contribution_receipt_date" \ --data-urlencode "per_page=20" \ --data-urlencode "api_key=$API_KEY" \ ${STATE:+--data-urlencode "contributor_state=$STATE"} ``` 2. Build optional arguments with a Bash array rather than concatenating strings. 3. Validate state input against an allowlist such as `^[A-Z]{2}$`. 4. Apply length limits and reject control characters in all input fields. 5. Percent-encode the Sunbiz search term using a proper URL encoder rather than manually replacing spaces. 6. Add tests covering names with apostrophes, hyphens, accented characters, ampersands, percent signs, and other reserved characters. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description claims a comprehensive people-investigation capability across numerous record types and OSINT sources. The supplied code does not implement that broad behavior; it only searches Federal Election Commission individual contribution data for a named person, optionally filtered by state. While political donation records could be one small component of background research, this code chunk's actual primary purpose is much narrower and materially different from the declared skill purpose. Therefore this is a clear description-behavior mismatch.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger phrases are extremely broad, so the skill may activate for many generic requests about a person and then begin collecting sensitive data. Overbroad invocation increases the chance of unintended use, privacy-invasive behavior, and bypass of safer, narrower workflows.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill immediately frames the task as finding 'everything' about a target person and collecting identity anchors without an up-front privacy warning or legitimacy check. This encourages intrusive data aggregation and normalizes collecting sensitive personal data before establishing whether the request is appropriate.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill explicitly directs the agent to search private internal sources such as Google Takeout, call history, message archives, and memory files while presenting itself as a public-records investigator. This is dangerous because it silently pivots from OSINT to non-public personal data extraction, enabling unauthorized surveillance and exposure of highly sensitive information.

Ssd 3

High

• Confidence: 99% confidence
• Finding: These instructions direct mining of internal personal data stores and extraction of sensitive identifiers such as phone numbers, addresses, DOB, employers, and message history. Centralizing that data creates a powerful dossier for doxxing, stalking, impersonation, social engineering, or broader privacy abuse.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The report template instructs the agent to compile a consolidated dossier containing contact details, addresses, family relationships, legal records, and financial indicators. Even if each item were sourced individually, packaging them together materially increases harm by enabling profiling, doxxing, stalking, coercion, and identity-related abuse.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill's privacy section claims only public information will be used, but earlier steps instruct access to non-public personal archives. That contradiction is dangerous because it misleads users and reviewers about the real data handling behavior, increasing the risk of covert privacy violations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell-style commands against local data stores but declares no explicit tool scope or permission boundary. That makes data access harder to audit and increases the chance the agent can read local files beyond what a user would reasonably expect from a people-search skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Common names = common problem. Always:

1. **Never attribute info without verification** against at least one identity anchor
2. **Document "NOT this person"** findings explicitly (like known associates in a different city)
3. **When in doubt, say so** — "Possibly the same person, but unconfirmed" > wrong attribution
4. **Ask the user** if a specific detail would help disambiguate (e.g., "Do you know his middle name?")

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This file is a curated playbook for doxxing-adjacent people search using public records, contact details, associates, address history, breach checks, and social profile correlation, but it provides no legal, privacy, consent, or abuse-limiting guidance. In the context of a 'personal investigator / people lookup' skill, the omission materially increases the likelihood of stalking, harassment, targeted phishing, and non-consensual profiling because the content operationalizes sensitive person-identification techniques for arbitrary targets.

External Transmission

Medium

• Category: Data Exfiltration

Content

NAME="${1:?Usage: fec-lookup.sh \"First Last\" [STATE]}"
STATE="${2:-}"

BASE="https://api.open.fec.gov/v1/schedules/schedule_a/"
# FEC API key (demo key, rate-limited but functional)
API_KEY="DEMO_KEY"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script takes a person's name, city, and state and constructs direct links to multiple third-party people-search and records services, disclosing user-supplied personal-identifying search terms to external sites without any consent, warning, or minimization. In a skill explicitly designed for background research on people, this creates a meaningful privacy risk because sensitive investigative targets may be exposed to commercial data brokers or external logging systems.

Static analysis

No suspicious patterns detected.