other
Warning
- Location
- SKILL.md:68
- Finding
- Excessive Collection and Third-Party Disclosure of Personal Profile Data## Vulnerability Details **File Location**: `SKILL.md`, lines 68 and 199–203 **Vulnerability Type**: `other: Excessive Personal Data Collection` **Risk Level**: Medium ### Vulnerable Skill Text The relevant skill text states, translated into English: ```text Before starting: Calls to this service send the analyzed person's date of birth (including hour and minute), gender, birthplace, and current location to the Xinjianxue API at chinaapi.xinjianxue.com for processing. Complete input: Date and time of birth, gender, birthplace (country and province/region/city), and current location. Basic input: Date of birth, gender, and current location. Both input tiers must provide gender, date of birth, and the analyzed person's current location (country and province/region/city). ``` ### Technical Analysis The Skill provides advice about social etiquette, interpersonal boundaries, gift customs, requests, and polite refusals. It nevertheless requires the subject's date of birth, gender, and current country and province, region, or city for both report tiers. A more detailed tier additionally processes the exact birth time and birthplace. These attributes are sent to the external service at `https://chinaapi.xinjianxue.com`. The combination of birth information, gender, birthplace, and current location can identify or enable detailed profiling of an individual. Mandatory collection is broader than the information ordinarily necessary to answer general social-etiquette questions. The Skill does include mitigating controls: it instructs the Agent to disclose the transfer, obtain consent before starting, avoid analysis of an unconsenting third party, and avoid locally retaining reports. It also asserts that the service does not store the submitted information. However, no code or independently verifiable mechanism in the audited package enforces the external provider's retention claim, deletion behavior, access controls, or l ...[truncated 2048 chars]
- Remediation
- ## Remediation Suggestions 1. Provide a local, non-profiled advice mode that answers ordinary social-etiquette questions without requesting birth, gender, or location data. 2. Make external report generation optional rather than mandatory for use of the adviser role. 3. Apply strict purpose limitation: collect only situational details directly relevant to the user's question, such as relationship, occasion, cultural context, and stated boundaries. 4. Where geography is genuinely relevant, request the least precise information possible, such as country or broad cultural region rather than province or city. 5. Request birth date, exact birth time, gender, and birthplace only when the user explicitly selects a feature that demonstrably requires those fields. 6. Present a separate, immediate consent prompt before transmission that lists every field, the receiving domain, the purpose, the cost, and the retention policy. 7. Allow users to inspect and remove individual fields before the request is sent. 8. Publish verifiable server-side retention, deletion, access-control, breach-response, and subprocessors policies rather than relying solely on an assertion in the Skill. 9. Add contractual and technical controls preventing secondary use, advertising, unrelated profiling, or redistribution. 10. Continue enforcing the existing restriction against submitting data about an unconsenting third party, and require explicit confirmation from the analyzed person when that person is not the user. 11. Document transport security, request logging behavior, redaction practices, and deletion timelines for the external API. 12. Ensure errors, telemetry, and billing records never contain raw birth or location fields.