read-personal-data-harvester
Warn
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses highly sensitive local data, including the internal SQLite databases of the WeChat Read application ("~/Library/Containers/...") and browser profiles. This allows the agent to harvest extensive personal history and potentially access authenticated sessions to collect data from platforms like Douban and Bilibili.
- [COMMAND_EXECUTION]: The skill establishes persistence on the host system by instructing the agent to modify the user's crontab and create a launchd agent ("~/Library/LaunchAgents/com.personal-harvest.plist"). This ensures the harvesting scripts run automatically in the background at scheduled intervals.
- [PROMPT_INJECTION]: The skill processes untrusted data (book titles, comments, and post descriptions) from third-party websites. This data is interpolated into local database queries and agent context without sanitization, creating an attack surface for indirect prompt injection where malicious content on a webpage could influence agent behavior.
- Ingestion points: External platform data (Douban, Bilibili, Xiaohongshu) ingested via Playwright and local file parsing.
- Boundary markers: Absent. Content is directly mapped to dictionary fields and SQL queries.
- Capability inventory: Subprocess calls (bash), file-write (SQLite), network operations (Playwright, requests).
- Sanitization: No escaping or validation is performed on the scraped content before storage or processing.
Audit Metadata