Not a story about privacy being stripped bare, but a case study in where the line between experience and data safety should sit.
- Why can the system read it? Desktop operating systems typically do not display pop-up windows for each read of a regular file; technical feasibility does not equate to a reasonable product.
- Why ask about migration? Skills are already close to users' work methods and development assets, and users should be informed and confirmed before importing them.
- How to restore trust? Competition among office agents is not only about capabilities, but also about boundaries, transparency, and data protection.
A Xiaohongshu user, "一只喵喵喵," posted a thread with a title that would give even the legal department of a tech company like Tencent a heart attack: "Doubao Jobs Expose Your Privacy." According to the original poster, Doubao Jobs scanned multiple Agent directories on the user's computer immediately after installation, uncovering Skills located under products like Codex, Claude, and Gemini. Some of these Skills were even developed by the authors themselves, yet to be released and still in testing. The entire process was conducted without prior notification or user-initiated action. The author's words are quite impactful: Doubao Jobs "ate everything up."
The Doubao team's public opinion management skills are quite commendable: according to screenshots in the comments section, the official customer service apologized to users and stated that "we have currently closed this function and will switch to a manual import method that users can choose themselves in the future."
The original post has since been deleted. Several questions remain and are worth examining: Can desktop apps really scan and copy files without authorization? Is it industry practice for agents to import skills from each other? Does this constitute a privacy violation? And, since Doubao Work was able to quickly disable this feature, why wasn't the user allowed to choose it in the first place?
“"Stripping away privacy" is indeed a bit of an overstatement.
Objectively speaking, the title of the original post on Xiaohongshu was indeed somewhat emotional.
What can be confirmed at present is that Doubao Work automatically scanned multiple preset Agent Skill directories and actively copied the Skills installed by other Agents to Doubao Work's relevant directories. However, the "full disk scan" mentioned in the original post lacks rigorous technical evidence. Doubao Work scanning a few known Agent directories is not the same as traversing all files on the entire hard drive.
In another screenshot shown by the author, Doubao Works explains that Skill discovery and list display occur locally and are not uploaded in batches; the system only reads the complete SKILL.md, puts it into the dialogue context, and sends it to the model server for inference when a Skill is actually invoked in the dialogue.
From a technical standpoint, this explanation makes sense. For a cloud-based model to function according to a skill, it naturally needs to see the skill instructions, just like a user pasting text into a chat box. Therefore, the conclusion that "Doubao exposes privacy" goes beyond the existing evidence. However, making such a sweeping accusation doesn't mean there's nothing beneath the surface: reading and importing other agents' skills without prompting is itself a product behavior that needs explanation.
Disk operations are not difficult for applications such as Agents.
Many people's first question is: If an app scans my files, doesn't the operating system need to pop up a window to request authorization?
If you are familiar with the authorization mechanisms of Android and iOS, this answer is somewhat counterintuitive: most of the time, desktop systems will not pop up a window for every ordinary file read.
Windows primarily relies on account access tokens and file ACLs (Access Control Lists) to determine whether a program can open a file. Since programs are launched by the current user, they typically inherit that user's permissions. As long as the ACL allows it, the system will grant the file handle to the program without prompting for a confirmation window every time a file is opened.
macOS adds a layer of TCC (Transparency Consent and Control) to traditional file permissions. It specifically manages privacy resources such as the camera, microphone, photos, and contacts, and also protects specific locations like the desktop, documents, downloads, and emails. When an app accesses these protected resources for the first time, the system may prompt you with a pop-up window; to obtain Full Disk Access, the user needs to enable it separately.
However, TCC doesn't assign a security guard to every folder in the user's directory. Hidden directories like .codex/skills and .claude/skills, if not located in protected locations such as the desktop, documents, or downloads, and are not subject to other file permission restrictions, can still be directly accessed by the app.
To summarize: From a purely technical perspective, it's not surprising that Doubao doesn't need to request "Skill directory read rights" from the operating system again.
Doubao's customer service representative was right on the other hand: Agents are indeed "stealing" each other's resources.“
According to the screenshot provided by the original author, Doubao Works explained this practice as an "industry-standard practice." This statement cannot be directly equated with "everyone can copy without asking," but it does capture half of the reality.
Current agent products are indeed actively reading and migrating assets left behind by other products. More precisely, the industry is treating skills, configurations, memories, MCPs, tool permissions, and working directories as user working environments that can be migrated. Common practices include detecting known directories during initialization, listing importable sources on the Import page, or allowing users to initiate migrations via commands.
The reason isn't complicated. Switching to a different chatbot is easy for a user, but switching to an agent that's been trained for months is troublesome. Skills, configurations, memory, MCP, tool permissions, and working directory collectively constitute the user's actual usage environment. If a new platform can seamlessly integrate the new system, the user won't need to retrain it all over again.
In this regard, there have indeed been some overly enthusiastic migration designs in the industry: not only copying, but also suggesting archiving the old directory; not only providing prompts, but also making the confirm button more convenient than the cancel button. The result is that the new tool is migrated, but the working environment of the old tool is passively changed. Once migration functionality crosses the line of "user confirmation," it easily goes from convenient to offensive.
Therefore, it is indeed a reality in the industry that agents are "stealing" each other's resources. Skills are becoming a portable user asset and a ready-made productivity that various platforms want to take over.
The other half of Doubao's work that she didn't mention: Why do others usually ask first?
Migration functionality is common in the industry, but that doesn't mean everyone should simply copy it.
Some open-source tools will check known directories during initialization and ask the user whether to migrate if they find other agents. Commercial agents that prioritize compliance and enterprise customers will usually place the import process on a clear Import page, or wait for the user to enter the import command before starting the scanning and display.
One method involves automatic detection followed by a notification, while the other requires manual initiation by the user. The paths differ, but the common thread is clear: the user is aware of and actively agrees to the migration.
Similar scenarios have existed for a long time. Browser bookmarks are essentially files or databases on a user's computer. Edge can read Chrome's bookmarks, and Chrome can find data from other browsers. Operating systems generally don't determine for the browser whether or not these bookmarks should be moved.
Therefore, the browser itself adds this step: upon first launch, it explicitly tells the user which browsers have been discovered and asks whether to import bookmarks, history, or passwords. Only after the user confirms will it begin the import process.
This isn't an operating system forcing a pop-up window in the browser; rather, the product is proactively giving the user the choice. The system grants file access capabilities, while the user decides the specific data migration. A Skill is more complex than a bookmark; it might contain custom-developed scripts, workflows, and test content. A browser might ask questions about moving a few URLs, so an Agent moving an entire workflow should certainly be notified beforehand.
Don't assume that European and American agents are necessarily more concerned about user experience; the pressure of legal consequences, often involving monetary penalties, is the driving force behind design decisions. Article 5, Paragraph 3 of the EU's ePrivacy Directive stipulates that, in principle, access to information already stored on a user's terminal device requires explicit notification and consent; exceptions may only apply to access that is strictly necessary to fulfill the user's explicit request for a service. If the user has not actively requested the skill migration, the reason of "necessary to fulfill the user's request" is difficult to justify.
If the skill includes personal data such as names, customer information, and internal processes, the GDPR further requires transparent processing, clear purpose, minimal scope, and implementation of default data protection. While there is no single federal law in the United States that fully corresponds to the GDPR, the California CCPA also requires applicable companies to state the category and purpose of personal information before collecting it and to ensure that the collection is reasonable and proportionate to its purpose. The U.S. FTC has also long included practices such as concealing data processing and violating existing privacy commitments within its regulatory scope of "unfair or deceptive business practices."
Of course, these laws cannot be used to conclude that "Doubao Work must have violated the law this time." Which country's laws apply to the product, whether local scanning constitutes collection in a specific legal sense, and whether the Skill contains personal information all require specific judgment.
But these factors sufficiently explain why international products would rather create an additional import page than simply copy the existing code. Asking users one more question is inexpensive; however, it can significantly reduce post-launch problems for the company's legal and compliance departments. The penalties under GDPR are enough to make any serious company take it seriously.
Bulk uploads are unlikely, and even self-developed skills cannot be easily copied.
To put it a little more cynically, when people see one error, they unconsciously suspect whether there are other errors as well. The same applies here; many people will ask: "Did it copy and paste without asking me? Did it upload it without asking me either?"
This concern is understandable, but from the perspective of interests and technical logic, there is not much need for Doubao to upload all skills in batches.
First, many general-purpose skills are already publicly available files, which the platform can easily obtain from public repositories; there's no need to go through the user's computer to retrieve them again. Second, as long as the model is running in the cloud, the platform can already see what tasks the user submits in Doubao Work, which skills they call, and how they correct the results. Secretly packaging local skills just to understand Doubao Work usage is somewhat redundant.
Individualized skills and debugging data can indeed be valuable, but a single user's minor modification is hardly a goldmine. What truly has training value is often a large-scale "task-execution-failure-correction-success" trajectory. A single, isolated SKILL.md file lacks context and may not even be compatible with other environments.
However, the original author specifically emphasized that some of these skills were not downloaded from public channels, but were private skills that he developed himself, have not yet made public, and are still in testing.
These skills are essentially close to an unreleased software and workflow. Besides SKILL.md, they may also contain scripts written by the author, tool invocation methods, test code, and business rules. Whether it has significant commercial value is one thing; whether to allow another agent to read and copy it should be decided by the developer.
Even if Doubao Work only performs the replication locally, it still allows these non-public skills to be discovered and invoked by another agent. According to Doubao Work's explanation, once a skill is actually invoked in a conversation, its full content is sent as context to the cloud model. Therefore, local replication itself expands the scope within which these self-developed skills can be read and transmitted.
There is currently no evidence to prove that Doubao uploaded Skills in bulk, and this needs to be clarified. However, the lack of evidence of bulk uploads does not justify copying non-public Skills without consent. This is no longer about migrating a public resource, but about directly copying someone else's unreleased development results into one's own system.
The quick response is commendable, but it would be even better if the choice were given to the customer beforehand.
Doubao's processing speed is commendable. Customer service didn't continue to stubbornly insist on "industry practice," but quickly shut down the function and clearly stated that future imports would be manually selected by the user. At least judging from the results, the team listened.
But this also leaves an interesting question: since the function can be quickly turned off, why wasn't a confirmation process prepared in the first place?
Doubao has clearly set up a cloud-based switch for this feature, a common feature flag in product development. Once customer service decides to disable it, the backend simply needs to change a configuration like `auto_import_skills` from enabled to disabled. The next time the client retrieves the configuration, it will no longer automatically import skills from other agents. In fact, simply adding a configuration option to import recommendation pages in addition to On and Off, and setting it as the default, can effectively balance user data protection and product experience. I believe that ByteDance's team is already using Trae for Vibe coding today; these types of pages, along with their basic logic, are not a very heavy development task.
Turn a dispute into an opportunity to build trust.
Doubao Work was not proven to have "exposed all user privacy" this time. Its problem is more specific and easier to solve: a migration function that was originally valuable omitted the confirmation that users should have had.
Office scenarios and ordinary home software are ultimately different. Agents may be dealing with contracts, financial data, code, customer information, and internal processes. Users don't just care about how well the app works; they also care about what the app sees, what it copies, what stays locally, and what goes to the cloud. Even if users themselves lack the ability to distinguish these differences, this concern is still worth taking seriously.
Doubao's ability to quickly disable the feature and promise adjustments demonstrates the team's responsiveness to users. If they can further enhance data protection transparency and make detection, import, and cloud synchronization clear and optional processes, this controversy may not just be a liability.
For office agents, data protection is itself a product capability. The clearer the boundaries are defined, the more confident users are in entrusting them with important tasks; the stronger the trust, the smoother the product will enter personal office and enterprise scenarios.
Allowing the app to read the operating system only solves the technical problem. The real product problem is enabling users to know and make choices. Doubao has already taken a step towards this correction; the next step is to transform the backend's operational control into the user's right to know in the foreground.
