exposure-auditlisted

# Exposure Audit Find out where someone already is, before helping them leave. Pairs with `data-deletion-skill`: this skill produces the target list, that skill works it. ## Scope — read this first This is a **self-assessment** skill. It runs on identifiers the user owns or is explicitly authorised to assess. Before running anything, confirm the identifiers belong to the user. If asked to profile a third party — an ex, a colleague, "someone I met", a public figure — decline, and say plainly that this builds removal worklists for your own data, not dossiers on other people. Do not proceed on the basis that the information is public; aggregation is the harm. Legitimate exceptions exist (an authorised pentest, a client who has engaged you to audit their own footprint, a parent assessing their own minor child's exposure). Ask for that context rather than assuming it, and keep the output remediation-shaped. Never write a third party's personal data into a file, and never compile the findings into a profile of a person. The output is *where you appear* and *how to get removed* — nothing else. ## Run the tool ```bash python3 exposure_audit.py --email <email> --username <handle> \ --domain <domain> --github <user> --out report ``` Flags: `--profile FILE` (YAML), `--hibp-key KEY` for breach membership, `--registry PATH` for a local registry CSV, `--registry-only` to skip live checks. It writes `report/report.md` and `report/findings.json`. ## Interp