other
Warning
- Location
- SKILL.md:179
- Finding
- Excessive Collection and External Transmission of Sensitive Personal Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 179–209 **Vulnerability Type**: Excessive Personal Data Collection **Risk Level**: Medium ### Evidence The audited skill requires an analysis subject's sex, birth date, and current location for every report. It additionally collects an exact birth time and birthplace for the complete report tier. The following is an English rendering of the relevant specification and request example: ```markdown - Both tiers require: sex, birth date, and the subject's current location (country and province/region/city). - The complete tier additionally requires: exact birth hour and minute, and birthplace (country and province/region/city). - When analyzing multiple people, send a `people` array containing an entry for each person. - If information is missing, the AI must request it before calling the API. ``` ```json { "license": "XJX-AI-xxxxxxxxxxxxxxxx", "api_key": "<API_KEY>", "birth": "1990-01-01 08:30", "gender": "<SEX>", "country": "<BIRTH_COUNTRY>", "place": "<BIRTH_PROVINCE_AND_CITY>", "current_country": "<CURRENT_COUNTRY>", "current_place": "<CURRENT_PROVINCE_AND_CITY>" } ``` The disclosure notice elsewhere in the file states that birth date and time, sex, birthplace, and current location are transmitted to `chinaapi.xinjianxue.com` for processing. ### Technical Analysis The skill is intended to provide advice concerning school peer relationships. Nevertheless, it makes several sensitive demographic and location fields mandatory before advice can be generated through the external report service. The documentation does not establish why exact birth details, birthplace, sex, or province/city-level current location are technically necessary for that purpose. This conflicts with data-minimization and purpose-limitation principles. Consent and a pre-transmission notice are included, but consent alone does not establish that every requested field is proportionate or necess ...[truncated 2418 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make birth details, sex, birthplace, and current location optional unless each field has a documented and technically justified purpose. 2. Default to providing relationship advice from the user's description of the social situation without invoking the external report service. 3. Apply field-level data minimization. If location is genuinely required, request only the least precise region necessary rather than province/city-level information. 4. Do not submit another person's personal data based solely on the user's assertion of consent. Prefer analysis based on the user's own experiences and observations. 5. Where third-party processing is unavoidable, require an explicit confirmation immediately before transmission that lists: - Every field being transmitted - The receiving domain - The processing purpose - Whether account credits will be consumed - The applicable retention and deletion policy 6. Add special safeguards for minors, including prohibiting unnecessary collection of exact birth times and precise current locations. 7. Publish and link a verifiable privacy policy describing retention, subprocessors, deletion procedures, security controls, and user rights. 8. Allow users to review, remove, or coarsen individual fields before the API request is sent. 9. Add a non-network fallback so declining data collection does not prevent the user from receiving general relationship guidance. ]]>