privacy-auditor

Privacy Audit

Help users scan their local system for privacy risks: exposed credentials, overly permissive files, and sensitive data leaks.

Use Cases

• The user says "Help me check if my computer has any security risks" or "Scan for privacy risks"
• The user says "Check whether any passwords are stored in plaintext" or "Are the permissions on sensitive files correct?"
• The user says "I want to clean up browser tracking data"

Execution Method

Scan the local file system via bash commands to check for common privacy risks.

1. Check for exposed credentials

# 搜索可能包含密码/密钥的文件（仅检查文件名，不读取内容）
find ~ -maxdepth 3 -type f \( \
  -name "*.pem" -o -name "*.key" -o -name "*.env" \
  -o -name "credentials*" -o -name "*.keystore" \
  -o -name "id_rsa" -o -name "id_ed25519" \
\) 2>/dev/null

2. Check SSH key permissions

# SSH 密钥应为 600，目录应为 700
ls -la ~/.ssh/ 2>/dev/null

# 检查权限是否正确
stat -f "%Sp %N" ~/.ssh/* 2>/dev/null || stat -c "%A %n" ~/.ssh/* 2>/dev/null

3. Check for sensitive files in public directories

# Desktop 和 Downloads 中的敏感文件
find ~/Desktop ~/Downloads -maxdepth 2 -type f \( \
  -name "*.csv" -o -name "*.xls*" -o -name "*.sql" \
  -o -name "*.bak" -o -name "*.dump" \
\) 2>/dev/null | head -20

4. Check browser data

# Chrome cookies/history 大小
du -sh ~/Library/Application\ Support/Google/Chrome/Default/Cookies 2>/dev/null
du -sh ~/Library/Application\ Support/Google/Chrome/Default/History 2>/dev/null

# Firefox
du -sh ~/Library/Application\ Support/Firefox/Profiles/*/cookies.sqlite 2>/dev/null

5. Check recently accessed sensitive files

# macOS 最近打开的文件
ls -lt ~/Library/Recent\ Documents/ 2>/dev/null | head -10

# 最近修改的大文件
find ~ -maxdepth 3 -type f -mtime -7 -size +10M 2>/dev/null | head -20

Audit Report

## 隐私审计报告

**扫描时间**: YYYY-MM-DD HH:MM
**扫描范围**: 用户主目录

### 风险等级汇总
- 🔴 高风险: X 项
- 🟡 中风险: X 项
- 🟢 低风险/信息: X 项

### 详细发现

#### 🔴 高风险
| 发现 | 位置 | 建议 |
|---|---|---|
| SSH 私钥权限过大 | ~/.ssh/id_rsa (644) | 修改为 600 |

#### 🟡 中风险
| 发现 | 位置 | 建议 |
|---|---|---|
| .env 文件在公共目录 | ~/Desktop/.env | 移到安全位置 |

#### 修复建议
1. [具体修复命令]

Security Rules

• Only check file names and permissions, do not read file contents
• Do not modify any files: only report risks, fixes require user confirmation
• Scan results are not persisted: after the report is displayed, it is not stored to disk
• Do not scan other users' directories: only scan the current user's HOME

Output Specifications

• Display sorted by risk level
• Each risk comes with a one-click fix command
• Fix commands must be confirmed by the user via HITL before execution