Security audit

Privacy Eraser

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to help remove exposed personal information, but it also directs agents to use logged-in browser sessions, submit reports automatically, store evidence, and create recurring monitoring without enough user control.

Install only after review. Keep this skill in draft-and-guidance mode unless you explicitly approve each external action. Do not let it use USER.md, your authenticated Chrome profile, upload identity documents, submit legal claims, or create cron monitoring unless the exact data, destination, text, schedule, retention, and cancellation path are clear. Use DMCA only for genuine copyright claims and redact identity materials whenever possible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:35
Finding: Unbounded Access to Agent-Stored Identity Information## Vulnerability Details **File Location**: `SKILL.md`, lines 35-43 **Vulnerability Type**: Unauthorized access to persistent Agent profile data **Risk Level**: High **Relevant Source Excerpt — English Rendering**: ```text Scan mode: User: Check whether my information appears online. Agent actions: 1. Read the user's identity information from USER.md. 2. Search Baidu and Bing. 3. Report only problematic content. 4. Provide the most effective remediation. ``` ### Technical Analysis The workflow directs the Agent to read identity information from `USER.md` automatically. It does not limit which fields may be accessed, require the user to select the identifiers needed for the current search, or establish retention and disclosure boundaries. This violates least-privilege principles because the legitimate operation only requires specific identifiers explicitly approved by the user. A profile file may contain unrelated personal information that is unnecessary for a particular search. Using those values in external search queries also discloses them to third-party search providers. ### Attack Path 1. A user or malicious prompt triggers the privacy scanning workflow. 2. The Skill directs the Agent to access `USER.md`. 3. The Agent reads identity fields without a per-field authorization boundary. 4. Those identifiers are incorporated into external Baidu or Bing searches. 5. Search providers, browser history, logs, or screenshots retain the submitted identifiers. ### Impact Assessment The workflow may obtain access to any identity information stored in `USER.md`, potentially including names, contact information, addresses, employers, schools, or other profile data. The scope includes local Agent state and any external services to which search queries are sent. Exploitation does not grant operating-system privileges, but it can expose persistent personal information beyond what the user supplied for the current t ...[truncated 4 chars]
Remediation: ## Remediation Suggestions - Prohibit automatic or bulk reading of `USER.md`. - Ask the user to provide or explicitly approve each identifier used in a search. - Present the exact search queries before sending them to third parties. - Restrict access to the minimum fields needed for the current case. - Avoid recording raw identifiers in logs, screenshots, browser history, or case files. - Define retention and deletion rules for search results containing personal information. - Require renewed consent before using stored profile information in later sessions.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:66
Finding: Automatic Submission of Complaints Through Authenticated Browser Sessions## Vulnerability Details **File Location**: `SKILL.md`, lines 66-95 **Vulnerability Type**: Unauthorized use of authenticated user sessions for irreversible external actions **Risk Level**: High **Relevant Source Excerpt — English Rendering**: ```text Automatic reporting workflow requiring a Mac node: 1. Check for an available Mac node. 2. If one exists, use the node's Chrome browser profile. 3. Navigate to the target URL. 4. Identify the platform and automate the report: - Open the report interface. - Select the privacy violation category. - Fill in the explanation. - Submit the report. 5. Archive a screenshot. 6. Record the action in the cases directory. ``` Additional directives at lines 297-302 state that the user's browser is already authenticated, that cookies do not need to be provided manually, and that the process should be fully automatic without user awareness during execution. ### Technical Analysis The Skill reuses an authenticated Chrome profile to perform externally visible actions under the user's platform accounts. Submission is irreversible or consequential, but the workflow does not require: - A preview of the final complaint. - Verification that the user is the affected person or authorized representative. - Confirmation of the selected legal or platform-reporting category. - Explicit approval immediately before submission. - Validation of attached identity documents or factual assertions. Possession of an authenticated browser session is treated as sufficient authorization. This conflates technical capability with informed user consent and allows the Agent to exercise account privileges beyond a safe draft-generation function. ### Attack Path 1. An attacker, untrusted page, or mistaken user instruction supplies a target URL. 2. The Skill detects an available Mac node. 3. It opens the user's authenticated Chrome profile. 4. It navigates to the target platform a ...[truncated 810 chars]
Remediation: ## Remediation Suggestions - Default to generating drafts and instructions rather than submitting reports. - Require explicit confirmation immediately before every consequential action. - Show the user the destination, complaint category, complete final text, URLs, and attachments. - Verify that the user is the affected person, rights holder, or authorized representative. - Never infer authorization solely from access to an authenticated browser profile. - Require separate confirmation for sending messages, uploading identity documents, and submitting sworn statements. - Use a restricted browser profile with access only to the platform required for the task. - Keep an audit log of approvals while excluding raw identity documents and unnecessary personal data.

T06 · System Persistence

Warning

Location: SKILL.md:269
Finding: Persistent Weekly Monitoring Through a Scheduled System Event## Vulnerability Details **File Location**: `SKILL.md`, lines 269-277 **Vulnerability Type**: Cross-session scheduled execution **Risk Level**: Medium **Relevant Source Excerpt — English Rendering**: ```json { "schedule": { "kind": "cron", "expr": "0 9 * * 1", "tz": "Asia/Shanghai" }, "payload": { "kind": "systemEvent", "text": "Privacy monitoring: search for the user's name, check for new personal-information exposure, and notify the user if any is found." }, "sessionTarget": "main" } ``` ### Technical Analysis The monitoring workflow creates a recurring cron task that targets the main Agent session. The task survives the initiating Skill run and repeatedly causes the Agent to search for the user's identity information. Although monitoring is part of the declared feature set, the configuration lacks an expiration date, cancellation procedure, per-run approval, restricted execution context, and explicit list of approved identifiers. Targeting the main session also increases the possibility that unrelated session state will influence the recurring task. ### Attack Path 1. Monitoring is enabled once. 2. The Skill creates a weekly cron schedule. 3. The schedule persists after the original conversation ends. 4. A system event is injected into the main session every week. 5. The Agent repeatedly searches for the user's name or other inferred identifiers. 6. Searches and notifications continue until the task is manually discovered and removed. ### Impact Assessment The persistence scope is the configured Agent environment and its main session. The task may repeatedly process and disclose personal identifiers to search providers, create unwanted notifications, and continue operating after the user's original need has ended. The finding does not establish a hidden backdoor, but it does establish recurring cross-session execution without adequate lifecycle controls.
Remediation: ## Remediation Suggestions - Require explicit confirmation of the schedule, timezone, identifiers, and search providers. - Assign a short default expiration date and require renewal. - Provide the task identifier and a clear cancellation command immediately after creation. - Run monitoring in an isolated context rather than the main session. - Restrict each run to an allowlist of user-approved search terms. - Notify the user before each run or provide an opt-in setting for silent execution. - Record execution metadata without storing complete search queries or exposed personal information. - Automatically disable the task after repeated failures or a defined inactivity period.

T09 · Insecure Skill Coding Practices

Error

Location: douyin_report.md:15
Finding: Excessive Collection and Storage Risk for Government Identity Documents## Vulnerability Details **File Location**: `douyin_report.md`, lines 15-19 **Vulnerability Type**: Unsafe handling of highly sensitive personal information **Risk Level**: High **Relevant Source Excerpt — English Rendering**: ```text Complaint material preparation: 1. Proof of identity - Photographs of both sides of the identity card. - A photograph of the person holding the identity card, described as optional but capable of accelerating processing. ``` Related instructions also appear in: - `baidu_removal.md`, lines 60-73. - `cyberspace_report.md`, lines 53-68. - `weixin_report.md`, lines 16 and 34-36. - `xiaohongshu_report.md`, lines 36-38. ### Technical Analysis The templates encourage users to provide complete identity-card images, identity numbers, and, in one case, a photograph of the user holding the identity card. The Skill does not consistently require redaction, watermarking, official destination verification, encrypted transfer, restricted storage, or deletion after submission. These documents combine stable government identifiers with facial images and contact details. They therefore require stronger safeguards than ordinary complaint text. The project's screenshot and case-archiving workflow further increases the chance that identity documents or completed forms will be retained locally. ### Attack Path 1. The user follows a platform complaint template. 2. The user supplies front and back identity-card images or a photograph holding the card. 3. The Agent opens an external submission endpoint through the browser. 4. The documents are uploaded or displayed in the browser session. 5. Screenshots, downloads, browser caches, or records in the `cases` directory retain copies. 6. Anyone with access to those locations may recover the identity material. ### Impact Assessment Exposed data may include the user's legal name, identity number, portrait, address, date of birth, contact infor ...[truncated 319 chars]
Remediation: ## Remediation Suggestions - Do not request identity documents unless an official platform explicitly requires them. - Verify the domain and form destination before advising any upload. - Explain exactly which fields are required and redact all others. - Watermark document copies with the recipient, purpose, and date. - Avoid requesting photographs of users holding identity documents unless legally mandatory. - Prohibit screenshots or archival copies of pages containing identity documents. - Exclude identity images and complete identity numbers from the `cases` directory. - Encrypt necessary temporary files and securely delete them immediately after submission. - Warn users that identity documents should never be sent to generic email addresses without verified secure procedures.

other

Error

Location: dmca_takedown.md:3
Finding: Facilitation of Unsupported Copyright Claims and Coordinated Reporting## Vulnerability Details **File Location**: `dmca_takedown.md`, lines 3-7 **Vulnerability Type**: Abuse of legal complaint mechanisms **Risk Level**: High **Relevant Source Excerpt — English Rendering**: ```text Applicable scenarios: - Your original content was copied. - Your photograph was used without authorization. - Your text was plagiarized. - The copyright framework can be "borrowed" to achieve content deletion. ``` The supplied DMCA template later requires the complainant to state under penalty of perjury that the information is accurate and that the complainant owns the copyright or is authorized to act for the owner. Separately, `SKILL.md`, lines 214-222, advises that reports from multiple people may accelerate handling. ### Technical Analysis Copyright removal and privacy removal are legally distinct mechanisms. Advising users that the copyright framework can be borrowed to obtain deletion creates a risk that a privacy dispute will be reframed as copyright infringement even when the user does not own the relevant work. The project supplies a formal notice containing a sworn accuracy and ownership statement. Although the file later warns that false DMCA claims may create liability, no technical or procedural control verifies ownership before generating or submitting the notice. Advice to use multiple reporters can also facilitate coordinated abuse of platform moderation systems. ### Attack Path 1. A user seeks removal of content for privacy, reputational, or personal reasons. 2. The user is encouraged to use the copyright framework as an alternative deletion mechanism. 3. The Skill generates a DMCA notice asserting ownership or authorization. 4. The authenticated browser or email workflow sends the complaint to the platform, host, or service provider. 5. Additional people may be encouraged to report the same content. 6. The target content may be restricted before the underlying rights claim is fully inv ...[truncated 595 chars]
Remediation: ## Remediation Suggestions - Remove all advice suggesting that copyright law may be borrowed for non-copyright disputes. - Clearly distinguish privacy, defamation, harassment, image-rights, and copyright remedies. - Require evidence that the user owns the copyrighted work or is authorized to act for the owner. - Require the user to identify the original work and the allegedly infringing material before generating a notice. - Never automatically submit a complaint containing a sworn or penalty-of-perjury statement. - Require explicit confirmation of every factual and legal assertion immediately before submission. - Remove advice encouraging multiple people to report the same content merely to accelerate moderation. - Direct uncertain users to qualified legal counsel and preserve neutral, draft-only assistance.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill explicitly directs the agent to control a logged-in browser on the user's Mac and perform account-bound actions automatically. This is dangerous because it enables submission, navigation, and other side effects under the user's authenticated sessions without clear per-action consent, materially exceeding a simple advisory/privacy-help function.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill describes using the user's logged-in browser to perform submissions but does not clearly warn that account-side actions and records will be created. Missing disclosure is dangerous here because the behavior has real-world side effects on third-party platforms and may surprise users who only requested help or information.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill contains detailed instructions for automatically filing platform reports and preserving evidence, turning it from an informational helper into an autonomous actor. This is dangerous because it can submit complaints, interact with third-party services, and create records under the user's authority without robust consent, review, or safeguards against misuse.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill openly promotes operating through the user's logged-in browser session 'without manual cookie provision' and '用户无感知,' which indicates invisible authenticated actions. This is especially dangerous because it lowers user awareness and bypasses normal friction around account use, enabling powerful side effects under existing sessions with minimal transparency.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The line explicitly suggests 'borrowing' the DMCA framework to achieve deletion goals, even when the situation may not be a legitimate copyright claim. This encourages misuse of a legal takedown process and could lead users to submit false or misleading copyright complaints, creating legal exposure and facilitating censorship or harassment.

Vague Triggers

High

Confidence: 97% confidence
Finding: This guidance lowers the barrier to abusing copyright complaint systems by framing DMCA as a tool for removing unwanted content outside clear copyright contexts. In a user-facing skill, that can operationalize fraudulent reporting and cause wrongful takedowns against lawful speech or third-party content.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: Encouraging potentially improper use of DMCA procedures is dangerous because it converts a legal remedy into a tactic for content suppression. The surrounding template and platform links make the misuse immediately actionable, increasing the likelihood of false complaints being filed at scale.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases are broad and overlap with ordinary privacy-related user requests, increasing the chance the skill will activate in contexts where the user expected only advice. Because the skill includes authenticated automation and persistent monitoring behaviors, accidental invocation materially raises the risk of unintended sensitive actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow accesses identity information from USER.md without a clear privacy notice, consent checkpoint, or data-use explanation. Given the sensitivity of identity attributes and the privacy-protection theme, failing to disclose this access undermines user expectations and increases the risk of overcollection.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs reading identity data from USER.md to drive searches and complaints, which pulls sensitive personal data into the workflow without data minimization. In a privacy-protection context, unnecessary access to identity records increases exposure risk and creates a contradiction between the stated purpose and actual handling of personal information.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill sets up recurring cron-based monitoring and proactive notifications without clearly warning the user that background activity will continue after the current interaction. This is dangerous because persistent operation changes the trust model and can lead to unnoticed ongoing processing of personal-information queries.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill enables recurring autonomous monitoring by creating scheduled scans, extending its behavior from one-time assistance into persistent operation. Persistent background processing increases privacy, surprise, and abuse risk, especially when it repeatedly handles identity-related searches without fresh consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The workflow stores screenshots and case records locally even though those artifacts may contain sensitive personal data, account details, URLs, and evidence of complaints. Retaining such material without clear necessity, disclosure, retention limits, or access controls creates secondary privacy and security risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill stores screenshots and case files from reporting workflows without warning the user that sensitive evidence may be retained locally. In a privacy-focused skill, silent retention of complaint artifacts and exposed personal data is especially risky because it creates additional copies of exactly the information the user is trying to remove.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: This section operationalizes direct interaction with an external legal-removal portal rather than merely providing guidance or templates. In the absence of an explicit manifest scope authorizing networked form submission, this is a stronger execution capability than a minimal privacy-advice skill would imply.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The cron configuration operationalizes recurring autonomous scans and notifications, which introduces ongoing background execution beyond a one-off request. Because the payload repeatedly searches for the user's personal information, it creates continuing privacy handling and surprise-action risk if enabled silently or too broadly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill includes a complaint template that encourages users to submit highly sensitive personal data, including ID numbers, phone numbers, addresses, and identity documents, but provides no warning about minimizing disclosure or securely handling supporting materials. This creates a privacy risk because users may overshare sensitive data to third parties or include unnecessary documents and screenshots that expose additional personal information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs users to provide highly sensitive personal data, including national ID numbers, phone numbers, and ID card photos, but does not include data minimization guidance, redaction advice, or privacy warnings. Even if the reporting destination is legitimate, collecting and encouraging transmission of more personal data than necessary increases the risk of secondary disclosure, oversharing, and misuse.

Ssd 4

Medium

Confidence: 94% confidence
Finding: By normalizing the idea that copyright complaints can be used beyond legitimate infringement claims, the document socially legitimizes abuse of legal reporting mechanisms. While less direct than step-by-step fraud instructions, in this context it still increases the risk of wrongful removals and legal misuse.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The template instructs users to include multiple personal identifiers and broad categories of personal data in an email, but it does not advise data minimization or limiting disclosures to what is necessary for identity verification and locating the account. That increases the chance of oversharing sensitive information through insecure channels, unnecessary retention by recipients, or exposure if the request is misdirected or intercepted.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The template invites users to provide identity documents to verify their claim, but gives no guidance to minimize disclosure, redact unnecessary fields, or use secure transmission. In a privacy-complaint context, this can cause users to send highly sensitive IDs to unknown or weakly verified recipients, creating additional privacy and identity-theft risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The English version repeats the same unsafe pattern by suggesting users provide identification documents without caution about over-sharing or secure handling. Because the recipient may be an arbitrary website operator or support inbox, this can expose users to unnecessary collection, retention, or compromise of sensitive identity data.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The entire skill is written in Chinese and does not indicate that it is intended only for Chinese-speaking users or offer an alternative language option. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The template explicitly prompts inclusion of highly sensitive personal data such as phone number, workplace, and home address in a document that is intended to be sent to an opposing party and possibly through multiple delivery channels. While this may be relevant to asserting a privacy claim, the template does not instruct users to minimize data, redact unnecessary identifiers, or handle the letter securely, which increases the risk of further privacy exposure or over-disclosure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The template instructs users to submit highly sensitive personal data such as phone numbers, ID numbers, addresses, and contact details, but it does not warn against over-sharing or recommend data minimization. In a complaint workflow, this creates a real privacy risk because users may copy full identifiers into tickets, screenshots, or platform messages that could be retained, exposed, or mishandled by support systems or unauthorized parties.

Static analysis

No suspicious patterns detected.