personal-data-harvester
Warn
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PERSISTENCE_MECHANISMS]: The skill provides detailed instructions and templates for establishing persistence on the host system. It includes crontab configurations and a macOS launchd plist (com.personal-harvest.plist) to automate the execution of harvesting scripts at regular intervals without user intervention.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive local data stored by other applications to extract user history. It targets the local SQLite databases of the WeChat Read desktop app (
/Library/Containers/com.tencent.WeReadMac/...) and personal Kindle reading logs (/Documents/My Clippings.txt). Additionally, it manages a persistent browser profile at ~/.config/personal-harvest-browser and saves authentication cookies to ~/.personal-harvest/cookies.json to maintain sessions for platforms like Douban and Bilibili.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from multiple external social platforms, creating a vector for indirect prompt injection if the harvested data is later processed by an AI agent.\n - Ingestion points: Scraper scripts for Douban, Bilibili, and WeChat Read (SKILL.md, references/platforms.md)\n
- Boundary markers: None identified in the provided scripts to delimit ingested data\n
- Capability inventory: File system read/write, local database access, and network requests across multiple scripts\n
- Sanitization: The skill does not implement sanitization or filtering of platform-sourced content before storage or agent consumption.\n- [COMMAND_EXECUTION]: The skill uses the bash tool to perform environment checks and system configuration. It executes shell commands to verify dependencies and provides command-line examples for setting up system-level persistence.
Audit Metadata