跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

What Leaked About You Skill 安全审计

作者说它能做什么（原文）

>-

第三方安全检查结论

先别安装或运行

已检查文件
3
发现的风险
4
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 1 项风险
中风险

结尾的“测试密码”例外与绝对禁止登录的规则冲突

原文依据：4 处
发现了什么

前文明确说即使获得客户口头许可也绝不能用泄露凭据认证；结尾却说，为数据主体工作是“唯一可以测试密码”的情形。这里没有明确把“测试”限定为离线的 Pwned Passwords 前缀查询。

为什么需要注意

用户可能把后一句理解为允许在客户账户上尝试泄露密码，从而造成未经充分授权的登录、账户锁定、审计告警或违反计算机滥用法律。

这段证据能说明什么

前文无条件禁止用泄露凭据登录、重置账户或测试跨站复用，并把合法检查方式描述为不恢复密码的范围 API；但结尾单独称为数据主体工作是“唯一适合测试密码”的情形。“测试”可能意指范围 API，也可能被误读为实际认证，文本没有在该句中限定。用户应要求作者明确：这里只允许本地哈希和 k-匿名查询，绝不向登录或找回流程提交密码。

这项判断针对展示的代码和适用条件，不表示风险已经实际发生。
SKILL.md:83来自说明文档打开原文件
**Never use a leaked credential to authenticate to anything.** Not to "confirmthe account exists". Not on a test account. Not on the subject's account with aclient's verbal blessing. Credential stuffing is unauthorized access undercomputer-misuse law in most jurisdictions, and the public availability of thepassword is not a defence — see [../../ETHICS.md](../../ETHICS.md).The same applies to derived actions: do not attempt password resets, do not userecovered security-question answers, and do not try a recovered password on adifferent service to test reuse. Reuse is something you *infer* from data youalready hold, never something you test.
查看另外 3 个位置
SKILL.md:212来自说明文档打开原文件
Practically: pull the minimum fields needed for the objective, do not retaincredentials at all, store case material encrypted at rest with access logged,and delete on a schedule you wrote down at the start. If you are working for asubject on their own data, that is the cleanest footing available — and it isthe only footing on which testing a password is ever appropriate.
reference/source-catalogue.md:57来自说明文档打开原文件
You hash the password with SHA-1 locally and send only the **first five hexcharacters** of the hash to the range endpoint. The service returns every hashsuffix in its corpus beginning with that prefix, along with how many times eachhas been seen. You compare locally.
SKILL.md:120来自说明文档打开原文件
security posture, which is genuinely useful in a due-diligence context. Thenstop. Cracking a hash produces a credential you are not allowed to use, so thework has no legitimate output. The exception is a self-audit or an authorizedsecurity assessment where the password holder is your client, and even then therange API answers the question without cracking anything.
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
中风险

商业泄露数据库会记录被查询的身份标识

原文依据：3 处
发现了什么

指南建议把邮箱、用户名、电话、姓名、IP、地址或哈希提交给商业记录服务；参考资料明确要求假设供应商会保留每个查询标识。对敏感案件而言，查询本身会向另一方暴露调查对象及调查兴趣。

为什么需要注意

供应商可能获得并留存目标的个人标识、调查关联和查询时间，扩大隐私暴露面；其保留、访问或后续使用不受本 Skill 控制。

商业服务会接收用于检索的邮箱、用户名、电话、姓名、IP 等身份标识，原文还明确要求假定供应商会记录并保留每个查询。敏感案件中，这会把调查对象和调查兴趣暴露给第三方。用户可要求作者说明各供应商的保留、删除和访问政策，并限制提交非必要标识。

reference/source-catalogue.md:80来自说明文档打开原文件
| Service | Characteristic strength ||---|---|| DeHashed | Broad multi-selector record search — email, username, name, phone, IP, address, hash — returning field values. The usual choice when you need to pivot from a non-email selector into records || IntelX | Indexes leaked *material* rather than only parsed user tables: documents, pastes, darkweb pages, historical captures. Closer to a search engine over leaked and obscure sources, with a selector-based query model || Snusbase | Fast search across an aggregated breach corpus with hash and password-field querying, oriented toward record retrieval |
查看另外 2 个位置
reference/source-catalogue.md:93来自说明文档打开原文件
  attribution on the specific record.- **Query logging.** Your searches are logged by the vendor. Assume every  selector you look up is retained, and consider what that means for a sensitive  case.- **Licence restrictions** frequently prohibit exactly the downstream uses
reference/source-catalogue.md:12来自说明文档打开原文件
**Searchable selectors.** Email-only lookup answers "was this address exposed".Multi-selector search — username, phone, name, IP, domain — is what lets youpivot *into* records from something other than an email, and that is usuallywhere the investigative value is.
中风险

调查流程可扩展为对他人的跨服务身份画像

原文依据：4 处
发现了什么

指南不仅检查泄露状态，还把服务成员关系、用户名、IP、姓名、出生日期和地址作为线索，继续查找其他账户、位置和关系。其目标包括 VIP 保护、招聘和供应商筛选，不限于本人自查。

为什么需要注意

在没有适当授权时，这会把一次泄露检查扩大为对个人兴趣、约会或健康服务、历史账户、位置及身份关系的敏感画像，可能暴露与安全补救无关的信息。

该流程主动把泄露记录中的服务成员关系、用户名、IP、姓名、出生日期和地址用于跨服务扩展调查，且适用范围不限于本人自查。这可能形成关于他人兴趣、位置、账户和身份关系的敏感画像。虽然文档要求最小化和合法依据，但仍存在隐私与误归属风险。用户可将范围限制为本人或有书面授权的对象，并禁止与既定目的无关的后续跳转。

SKILL.md:96来自说明文档打开原文件
Work the breach list as an account map. An email appearing in a gaming forum, afitness app, and a regional dating service tells you three platforms toinvestigate, three registration dates, and often three usernames — each one aseed for `hunt-a-handle`. The services themselves characterise the person:professional, regional, linguistic, and interest signals that no profile pagewould give you.
查看另外 3 个位置
SKILL.md:191来自说明文档打开原文件
| New selector | Skill ||---|---|| Username recovered from a record | `hunt-a-handle` || Additional email addresses | `what-an-email-reveals` || Phone number in a record | `whose-number-is-this` || Signup IP | `find-exposed-servers` || Name, DOB, address fields | `find-anyone`, `dig-through-data-brokers` || Corporate domain across many records | `x-ray-a-company` || The dump itself, circulating | `find-leaks-in-the-wild` || Service list as an entity map | `graph-the-network` |
SKILL.md:8来自说明文档打开原文件
  with, interpreting a combolist or credential dump, assessing credential compromise, or  auditing your own leaked personal data. Applies to incident response and account-takeover  triage, executive and VIP protection, pre-employment and vendor risk screening, and personal  privacy audits. Reference at useosint.com/skills/what-leaked-about-you.
SKILL.md:204来自说明文档打开原文件
Holding breach data is regulated, and more tightly than most OSINT material.Under GDPR and UK data protection law, breach records are personal data — oftenspecial-category data — and processing them needs a lawful basis, a definedretention period, and demonstrable data minimisation. Some jurisdictions treatpossession of certain stolen data as an offence in itself, irrespective of howyou obtained it. Several commercial services restrict their data by licence tospecific purposes; read the terms before you put results in a client report.
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 1 项风险
高风险

把泄露记录用于招聘或供应商筛选可能造成不当决策

原文依据：5 处
发现了什么

Skill 明确把“入职前和供应商风险筛选”列为用途，但同一材料说明部分许可证禁止招聘、租赁或信贷用途，而且记录可能陈旧、错误归因或完全伪造。指南没有要求被调查者同意、申诉或人工复核。

为什么需要注意

个人或企业可能因不可靠或被禁止使用的数据而失去工作或商业机会，并可能引发隐私、反歧视、合同或数据保护责任。

Skill 将入职前和供应商筛选列为用途，但资料同时说明某些许可证禁止招聘用途，且泄露记录可能伪造、错误归因或因号码和邮箱转让而指向错误的人。因此，用这些结果影响招聘或供应商决策存在合规和误判风险。源码未规定告知、申诉或独立人工复核。用户可要求这些结果仅作线索，不作为不利决定依据，并先核验许可和归属。

SKILL.md:8来自说明文档打开原文件
  with, interpreting a combolist or credential dump, assessing credential compromise, or  auditing your own leaked personal data. Applies to incident response and account-takeover  triage, executive and VIP protection, pre-employment and vendor risk screening, and personal  privacy audits. Reference at useosint.com/skills/what-leaked-about-you.
查看另外 4 个位置
reference/source-catalogue.md:28来自说明文档打开原文件
**Access and licence.** Free web lookup, keyed API, subscription, orpurpose-restricted licence. Some licences prohibit use in employment,tenancy, or credit decisions, or require you to be an accredited investigator.Read them before results reach a client.
SKILL.md:141来自说明文档打开原文件
  before X, not that it was active then.- **Absence proves nothing.** Not appearing in any corpus means the person's  services were not breached, or the breach was never published, or your source  does not carry it.- **Scrape-vs-breach confusion.** A dataset assembled by scraping public  profiles is not evidence of a compromise, and reporting it as one is a  factual error that damages a report's credibility.- **Stale attribution.** Email addresses and phone numbers get abandoned and  reassigned. A ten-year-old record may describe someone else entirely.- **Vendor overlap masquerading as corroboration.** Two commercial services
SKILL.md:132来自说明文档打开原文件
  service-enumeration value, which was the point.- **Recycled and fabricated breaches.** Old data gets repackaged under a new  name and sold as fresh. Some "breaches" are wholly invented, or are scrapes of  public profiles marketed as a hack. Check whether the alleged source has ever  acknowledged an incident, and whether the record structure matches what that  service would plausibly store.- **Breach date is not leak date.** Three separate dates matter: when the data
SKILL.md:147来自说明文档打开原文件
  factual error that damages a report's credibility.- **Stale attribution.** Email addresses and phone numbers get abandoned and  reassigned. A ten-year-old record may describe someone else entirely.- **Vendor overlap masquerading as corroboration.** Two commercial services

Skill 逻辑拆解

8 个说明模块

该 Skill 是一份调查指南，没有提供可执行脚本或安装步骤。它指导用户用 HIBP、Pwned Passwords 和商业泄露数据库查询身份标识并解释结果。

查看原文
SKILL.md:43来自说明文档打开原文件
## Choosing a source| Holding | Reach for | Why ||---|---|---|| An email, need a service list | Have I Been Pwned | Curated, deduplicated, names the breach and its data classes. Does not return credentials || A password you already hold (yours, or one in scope) | HIBP Pwned Passwords range API | Tells you if the password is in circulation without disclosing it || Need actual field values, or to search by username, phone, IP, or name | Keyed commercial services | The only way to pivot *into* records rather than just detecting membership || A specific dump circulating now | `find-leaks-in-the-wild` | Paste sites, forums, and channels, before anything indexes them |

指南明确禁止用泄露凭据登录、重置密码、使用安全问题答案或跨站测试密码复用，并建议不保留凭据。

查看原文
SKILL.md:81来自说明文档打开原文件
## The rule that has no exceptions**Never use a leaked credential to authenticate to anything.** Not to "confirmthe account exists". Not on a test account. Not on the subject's account with aclient's verbal blessing. Credential stuffing is unauthorized access undercomputer-misuse law in most jurisdictions, and the public availability of thepassword is not a defence — see [../../ETHICS.md](../../ETHICS.md).The same applies to derived actions: do not attempt password resets, do not userecovered security-question answers, and do not try a recovered password on adifferent service to test reuse. Reuse is something you *infer* from data youalready hold, never something you test.
SKILL.md:212来自说明文档打开原文件
Practically: pull the minimum fields needed for the objective, do not retaincredentials at all, store case material encrypted at rest with access logged,and delete on a schedule you wrote down at the start. If you are working for asubject on their own data, that is the cleanest footing available — and it isthe only footing on which testing a password is ever appropriate.

指南承认泄露记录可能不可靠：数据可能被重新包装、伪造、错误归因、过时或来自同一上游来源，因此搜索命中并不自动证明当前身份或账户状态。

查看原文
SKILL.md:132来自说明文档打开原文件
  service-enumeration value, which was the point.- **Recycled and fabricated breaches.** Old data gets repackaged under a new  name and sold as fresh. Some "breaches" are wholly invented, or are scrapes of  public profiles marketed as a hack. Check whether the alleged source has ever  acknowledged an incident, and whether the record structure matches what that  service would plausibly store.- **Breach date is not leak date.** Three separate dates matter: when the data  was taken, when it first circulated, and when your source ingested it. They  can be years apart. "Appeared in a breach dated X" says the account existed  before X, not that it was active then.- **Absence proves nothing.** Not appearing in any corpus means the person's  services were not breached, or the breach was never published, or your source  does not carry it.- **Scrape-vs-breach confusion.** A dataset assembled by scraping public  profiles is not evidence of a compromise, and reporting it as one is a  factual error that damages a report's credibility.- **Stale attribution.** Email addresses and phone numbers get abandoned and  reassigned. A ten-year-old record may describe someone else entirely.- **Vendor overlap masquerading as corroboration.** Two commercial services  agreeing frequently means they ingested the same dump.
从这里开始 · 工作说明SKILL.md
what-leaked-about-you
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 2 个章节，可在原文件中查看。

文件引用关系图

2 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录3 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • reference/record-fields.md已纳入全文
  • reference/source-catalogue.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • reference/record-fields.md配套文件
  • reference/source-catalogue.md配套文件

代码和说明中提到的操作

读取密钥或账号配置
SKILL.md:18来自说明文档打开原文件
this identity actually use. That service list is almost always worth more to aninvestigator than the credentials in the record — and the credentials are thepart you must never touch. Using a leaked password is unauthorized access, no
SKILL.md:29来自说明文档打开原文件
The metadata beats the credentials, every time:
SKILL.md:47来自说明文档打开原文件
|---|---|---|| An email, need a service list | Have I Been Pwned | Curated, deduplicated, names the breach and its data classes. Does not return credentials || A password you already hold (yours, or one in scope) | HIBP Pwned Passwords range API | Tells you if the password is in circulation without disclosing it |
读取了多少行
459
文件校验值（用于核对版本）
1ad584871a0870ef30f8fec165b0c9c6bcc8d2a9db330a36f950cfb640c26cbb