Skip to content
Report library
Purpose / Other

What Leaked About You Skill Security Audit

What the author says it does (original text)

>-

Independent security check

Do not install or run it yet

Files checked
3
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The closing password-testing exception conflicts with the absolute no-login rule

Source references: 4
What we found

Earlier text says never authenticate with a leaked credential, even with a client’s verbal blessing. The closing line then says working for the subject is the only situation in which “testing a password” is appropriate, without limiting “testing” to an offline Pwned Passwords prefix query.

Why this matters

A user could interpret the later sentence as permission to try a leaked password on the client’s account, causing insufficiently authorized access, account lockout, security alerts, or computer-misuse violations.

What this evidence establishes

Earlier text categorically forbids authenticating with leaked credentials, resets, and cross-service reuse tests, and presents the range API as the legitimate check that avoids recovery. The closing statement nevertheless calls work for the subject the only situation where “testing a password” is appropriate. “Testing” may mean the range API, but the sentence does not say so and could be read as permitting authentication. Users should ask the author to state explicitly that only local hashing and k-anonymity lookup are allowed, never submission to login or recovery flows.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:83In the instructionsOpen original file
**Never use a leaked credential to authenticate to anything.** Not to "confirmthe account exists". Not on a test account. Not on the subject's account with aclient's verbal blessing. Credential stuffing is unauthorized access undercomputer-misuse law in most jurisdictions, and the public availability of thepassword is not a defence — see [../../ETHICS.md](../../ETHICS.md).The same applies to derived actions: do not attempt password resets, do not userecovered security-question answers, and do not try a recovered password on adifferent service to test reuse. Reuse is something you *infer* from data youalready hold, never something you test.
Show 3 other places
SKILL.md:212In the instructionsOpen original file
Practically: pull the minimum fields needed for the objective, do not retaincredentials at all, store case material encrypted at rest with access logged,and delete on a schedule you wrote down at the start. If you are working for asubject on their own data, that is the cleanest footing available — and it isthe only footing on which testing a password is ever appropriate.
reference/source-catalogue.md:57In the instructionsOpen original file
You hash the password with SHA-1 locally and send only the **first five hexcharacters** of the hash to the range endpoint. The service returns every hashsuffix in its corpus beginning with that prefix, along with how many times eachhas been seen. You compare locally.
SKILL.md:120In the instructionsOpen original file
security posture, which is genuinely useful in a due-diligence context. Thenstop. Cracking a hash produces a credential you are not allowed to use, so thework has no legitimate output. The exception is a self-audit or an authorizedsecurity assessment where the password holder is your client, and even then therange API answers the question without cracking anything.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Commercial breach databases log the identity selectors searched

Source references: 3
What we found

The guide recommends submitting email addresses, usernames, phone numbers, names, IPs, addresses, or hashes to commercial record services. Its reference explicitly says to assume the vendor retains every selector. In a sensitive case, the query itself reveals both the subject and investigative interest to another party.

Why this matters

A vendor may obtain and retain the subject’s identifiers, investigative association, and query timing. This Skill cannot control the vendor’s retention, access, or later use.

Commercial services receive identity selectors such as email, username, phone, name, and IP, and the source explicitly says to assume every query is logged and retained. In a sensitive case, this can disclose both the subject and the investigative interest to a third party. Users can ask the author to document each vendor's retention, deletion, and access policies and restrict unnecessary selectors.

reference/source-catalogue.md:80In the instructionsOpen original file
| Service | Characteristic strength ||---|---|| DeHashed | Broad multi-selector record search — email, username, name, phone, IP, address, hash — returning field values. The usual choice when you need to pivot from a non-email selector into records || IntelX | Indexes leaked *material* rather than only parsed user tables: documents, pastes, darkweb pages, historical captures. Closer to a search engine over leaked and obscure sources, with a selector-based query model || Snusbase | Fast search across an aggregated breach corpus with hash and password-field querying, oriented toward record retrieval |
Show 2 other places
reference/source-catalogue.md:93In the instructionsOpen original file
  attribution on the specific record.- **Query logging.** Your searches are logged by the vendor. Assume every  selector you look up is retained, and consider what that means for a sensitive  case.- **Licence restrictions** frequently prohibit exactly the downstream uses
reference/source-catalogue.md:12In the instructionsOpen original file
**Searchable selectors.** Email-only lookup answers "was this address exposed".Multi-selector search — username, phone, name, IP, domain — is what lets youpivot *into* records from something other than an email, and that is usuallywhere the investigative value is.
Medium risk

The workflow can expand into cross-service profiling of another person

Source references: 4
What we found

The guide goes beyond exposure checking: it treats service membership, usernames, IPs, names, dates of birth, and addresses as leads for finding further accounts, locations, and relationships. Its stated uses include VIP protection, employment, and vendor screening rather than only self-audits.

Why this matters

Without suitable authorization, a breach check can become a sensitive profile of someone’s interests, dating or health services, historical accounts, location, and identity relationships—information unrelated to security remediation.

The workflow actively uses service membership, usernames, IP addresses, names, birth dates, and addresses from breach records to expand an investigation across services, and its stated scope is not limited to self-audits. This can build a sensitive profile of another person's interests, locations, accounts, and identity links. Although the document calls for minimisation and a lawful basis, privacy and misattribution risks remain. Users can restrict it to themselves or expressly authorized subjects and prohibit pivots unrelated to the stated purpose.

SKILL.md:96In the instructionsOpen original file
Work the breach list as an account map. An email appearing in a gaming forum, afitness app, and a regional dating service tells you three platforms toinvestigate, three registration dates, and often three usernames — each one aseed for `hunt-a-handle`. The services themselves characterise the person:professional, regional, linguistic, and interest signals that no profile pagewould give you.
Show 3 other places
SKILL.md:191In the instructionsOpen original file
| New selector | Skill ||---|---|| Username recovered from a record | `hunt-a-handle` || Additional email addresses | `what-an-email-reveals` || Phone number in a record | `whose-number-is-this` || Signup IP | `find-exposed-servers` || Name, DOB, address fields | `find-anyone`, `dig-through-data-brokers` || Corporate domain across many records | `x-ray-a-company` || The dump itself, circulating | `find-leaks-in-the-wild` || Service list as an entity map | `graph-the-network` |
SKILL.md:8In the instructionsOpen original file
  with, interpreting a combolist or credential dump, assessing credential compromise, or  auditing your own leaked personal data. Applies to incident response and account-takeover  triage, executive and VIP protection, pre-employment and vendor risk screening, and personal  privacy audits. Reference at useosint.com/skills/what-leaked-about-you.
SKILL.md:204In the instructionsOpen original file
Holding breach data is regulated, and more tightly than most OSINT material.Under GDPR and UK data protection law, breach records are personal data — oftenspecial-category data — and processing them needs a lawful basis, a definedretention period, and demonstrable data minimisation. Some jurisdictions treatpossession of certain stolen data as an offence in itself, irrespective of howyou obtained it. Several commercial services restrict their data by licence tospecific purposes; read the terms before you put results in a client report.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
High risk

Using breach records for employment or vendor screening can produce improper decisions

Source references: 5
What we found

The Skill expressly lists pre-employment and vendor-risk screening, while its own reference says some licenses prohibit employment, tenancy, or credit use. It also acknowledges that records can be stale, misattributed, or fabricated. It requires neither subject consent nor an appeal or human-review process.

Why this matters

A person or organization could lose employment or commercial opportunities because of unreliable or prohibited data, creating privacy, discrimination, contractual, or data-protection exposure.

The Skill names pre-employment and vendor screening as uses, while its own reference says some licences prohibit employment use. It also warns that records may be fabricated, misattributed, or tied to reassigned identifiers. Using such results in hiring or vendor decisions therefore creates licensing and false-attribution risks. The visible instructions do not require notice, appeal, or independent human review. Users can require results to remain investigative leads rather than grounds for adverse decisions, with licence and identity verification first.

SKILL.md:8In the instructionsOpen original file
  with, interpreting a combolist or credential dump, assessing credential compromise, or  auditing your own leaked personal data. Applies to incident response and account-takeover  triage, executive and VIP protection, pre-employment and vendor risk screening, and personal  privacy audits. Reference at useosint.com/skills/what-leaked-about-you.
Show 4 other places
reference/source-catalogue.md:28In the instructionsOpen original file
**Access and licence.** Free web lookup, keyed API, subscription, orpurpose-restricted licence. Some licences prohibit use in employment,tenancy, or credit decisions, or require you to be an accredited investigator.Read them before results reach a client.
SKILL.md:141In the instructionsOpen original file
  before X, not that it was active then.- **Absence proves nothing.** Not appearing in any corpus means the person's  services were not breached, or the breach was never published, or your source  does not carry it.- **Scrape-vs-breach confusion.** A dataset assembled by scraping public  profiles is not evidence of a compromise, and reporting it as one is a  factual error that damages a report's credibility.- **Stale attribution.** Email addresses and phone numbers get abandoned and  reassigned. A ten-year-old record may describe someone else entirely.- **Vendor overlap masquerading as corroboration.** Two commercial services
SKILL.md:132In the instructionsOpen original file
  service-enumeration value, which was the point.- **Recycled and fabricated breaches.** Old data gets repackaged under a new  name and sold as fresh. Some "breaches" are wholly invented, or are scrapes of  public profiles marketed as a hack. Check whether the alleged source has ever  acknowledged an incident, and whether the record structure matches what that  service would plausibly store.- **Breach date is not leak date.** Three separate dates matter: when the data
SKILL.md:147In the instructionsOpen original file
  factual error that damages a report's credibility.- **Stale attribution.** Email addresses and phone numbers get abandoned and  reassigned. A ten-year-old record may describe someone else entirely.- **Vendor overlap masquerading as corroboration.** Two commercial services

Inside this skill

8 instruction sections

This Skill is an investigative guide with no executable scripts or installation steps. It directs users to query identity selectors through HIBP, Pwned Passwords, and commercial breach databases and interpret the results.

View source
SKILL.md:43In the instructionsOpen original file
## Choosing a source| Holding | Reach for | Why ||---|---|---|| An email, need a service list | Have I Been Pwned | Curated, deduplicated, names the breach and its data classes. Does not return credentials || A password you already hold (yours, or one in scope) | HIBP Pwned Passwords range API | Tells you if the password is in circulation without disclosing it || Need actual field values, or to search by username, phone, IP, or name | Keyed commercial services | The only way to pivot *into* records rather than just detecting membership || A specific dump circulating now | `find-leaks-in-the-wild` | Paste sites, forums, and channels, before anything indexes them |

The guide explicitly prohibits authenticating with leaked credentials, initiating password resets, using security-question answers, or testing password reuse across services, and recommends not retaining credentials.

View source
SKILL.md:81In the instructionsOpen original file
## The rule that has no exceptions**Never use a leaked credential to authenticate to anything.** Not to "confirmthe account exists". Not on a test account. Not on the subject's account with aclient's verbal blessing. Credential stuffing is unauthorized access undercomputer-misuse law in most jurisdictions, and the public availability of thepassword is not a defence — see [../../ETHICS.md](../../ETHICS.md).The same applies to derived actions: do not attempt password resets, do not userecovered security-question answers, and do not try a recovered password on adifferent service to test reuse. Reuse is something you *infer* from data youalready hold, never something you test.
SKILL.md:212In the instructionsOpen original file
Practically: pull the minimum fields needed for the objective, do not retaincredentials at all, store case material encrypted at rest with access logged,and delete on a schedule you wrote down at the start. If you are working for asubject on their own data, that is the cleanest footing available — and it isthe only footing on which testing a password is ever appropriate.

The guide recognizes that breach records may be unreliable: data can be repackaged, fabricated, misattributed, stale, or copied from the same upstream source, so a search hit does not automatically establish current identity or account status.

View source
SKILL.md:132In the instructionsOpen original file
  service-enumeration value, which was the point.- **Recycled and fabricated breaches.** Old data gets repackaged under a new  name and sold as fresh. Some "breaches" are wholly invented, or are scrapes of  public profiles marketed as a hack. Check whether the alleged source has ever  acknowledged an incident, and whether the record structure matches what that  service would plausibly store.- **Breach date is not leak date.** Three separate dates matter: when the data  was taken, when it first circulated, and when your source ingested it. They  can be years apart. "Appeared in a breach dated X" says the account existed  before X, not that it was active then.- **Absence proves nothing.** Not appearing in any corpus means the person's  services were not breached, or the breach was never published, or your source  does not carry it.- **Scrape-vs-breach confusion.** A dataset assembled by scraping public  profiles is not evidence of a compromise, and reporting it as one is a  factual error that damages a report's credibility.- **Stale attribution.** Email addresses and phone numbers get abandoned and  reassigned. A ten-year-old record may describe someone else entirely.- **Vendor overlap masquerading as corroboration.** Two commercial services  agreeing frequently means they ingested the same dump.
Start here · InstructionsSKILL.md
what-leaked-about-you
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • reference/record-fields.mdFull text included
  • reference/source-catalogue.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • reference/record-fields.mdSupporting file
  • reference/source-catalogue.mdSupporting file

Operations mentioned in code and instructions

Read keys or account settings
SKILL.md:18In the instructionsOpen original file
this identity actually use. That service list is almost always worth more to aninvestigator than the credentials in the record — and the credentials are thepart you must never touch. Using a leaked password is unauthorized access, no
SKILL.md:29In the instructionsOpen original file
The metadata beats the credentials, every time:
SKILL.md:47In the instructionsOpen original file
|---|---|---|| An email, need a service list | Have I Been Pwned | Curated, deduplicated, names the breach and its data classes. Does not return credentials || A password you already hold (yours, or one in scope) | HIBP Pwned Passwords range API | Tells you if the password is in circulation without disclosing it |
Lines read
459
File checksum (to compare versions)
1ad584871a0870ef30f8fec165b0c9c6bcc8d2a9db330a36f950cfb640c26cbb