other
Warning
- Location
- SKILL.md:189
- Finding
- Mandatory Collection and External Transmission of Excessive Personal Data## Vulnerability Details **File Location**: `SKILL.md`, lines 189–215 **Vulnerability Type**: Excessive Personal Data Collection **Risk Level**: Medium ### Evidence The following is an English translation of the relevant requirements and request example: ```text Report input specification: Two input tiers are supported: - Complete: date and exact time of birth, gender, birthplace, and current location. - Basic: date of birth, gender, and current location. Both tiers must provide gender, date of birth, and the subject's current country and province, region, or city. The complete tier additionally requires the exact hour and minute of birth and the country and province, region, or city of birth. If the user has not provided every required field, the AI must request the missing information rather than calling the service with incomplete data. ``` ```json { "license": "XJX-AI-xxxxxxxxxxxxxxxx", "api_key": "<API_KEY>", "birth": "1990-01-01 08:30", "gender": "Female", "country": "China", "place": "Zhejiang Province, Hangzhou", "current_country": "China", "current_place": "Zhejiang Province, Hangzhou" } ``` ### Technical Analysis The Skill provides advice about colleague relationships, workplace boundaries, and communication. It nevertheless makes a subject's birth date, gender, and current location mandatory and optionally collects exact birth time and birthplace. It then directs the agent to transmit those fields to `https://chinaapi.xinjianxue.com`. These attributes are not technically necessary to provide ordinary workplace communication advice. Requiring them violates data-minimization principles and creates an external profiling channel. A combination of exact birth information, gender, birthplace, and current location may facilitate re-identification, particularly when names or multiple people are included. The Skill discloses the transmission and requires consent ...[truncated 1616 chars]
- Remediation
- ## Remediation Suggestions 1. Provide a local, data-minimized advice mode that operates only on the workplace scenario described by the user. 2. Remove mandatory collection of birth date, gender, and current location unless each field has a documented and demonstrable purpose. 3. Treat exact birth time, birthplace, names, and precise current location as optional and collect them only when strictly necessary. 4. Request field-specific, informed consent immediately before every external transmission. Clearly identify the recipient, purpose, fields, retention period, and applicable charge. 5. Use coarse location data instead of city-level location whenever location is genuinely necessary. 6. Do not submit third-party information unless meaningful consent can be verified. Prefer asking the consenting person to provide their information directly. 7. Add enforceable retention and deletion controls, including bounded server logs, automatic deletion, encryption in transit and at rest, and auditable access restrictions. 8. Publish a privacy policy covering subprocessors, retention, deletion requests, breach response, and restrictions on secondary profiling. 9. Separate credentials from report data where the API design permits and ensure credentials and personal information are redacted from application, proxy, and diagnostic logs.