unbroker – Security skill for AI agents

unbroker

Find where a person's personal information (name, addresses, phone, email, relatives) is exposed on

data brokers and people-search sites, then remove it - automatically where possible, with guided

human steps only where a site demands a CAPTCHA, government ID, phone call, or fax. Manages multiple

people independently. It does not defeat anti-bot systems, does not act on anyone without

recorded consent, and does not remove public records (voter/property/court) or accounts the

person controls.

The Python CLI (scripts/pdd.py) owns the deterministic state - config, dossiers + consent, the

broker database, tier planning, the ledger, drafts, reports, **email sending (SMTP), verification-link

polling (IMAP), and the autonomous action queue (next)**. You (the agent) do the scanning and

form-driving with native tools: web_extract and browser_exec for searching and web forms, and

cronjob for recurring re-scans. Runs can be entered from a phone number alone (spam-call

scrubbing), with the FTC Do Not Call registry one-shot (dnc) alongside the opt-outs.

Autonomy contract

This skill is designed to run hands-off. After intake (+ recorded consent) there are exactly TWO

legitimate human touchpoints: (1) the intake conversation itself, and (2) ONE consolidated human-task

digest at the end of the run ($PDD tasks). Between those:

• Never ask the operator to choose configuration. $PDD setup --auto detects capabilities and

picks the most autonomous valid config itself.

• Never pause before individual submissions when autonomy=full (the default): the consent

recorded at intake is standing authorization for T0-T2 opt-outs. The one exception: an action

carrying confirm_first: true (always set on dnc_register, a registry signup the intake consent

does not cover) waits for the operator's yes in every mode. (autonomy=assisted sets

confirm_first on every submission for cautious operators.)

• Never interrupt the run for human-only work. Record it (`record ... human_task_queued

--reason "..."`) and keep going; it all surfaces once in the final digest.

• Drive the whole run as a loop over $PDD next <subject> - it returns the exact ordered actions

to take right now (scan, poll verification, re-check, opt out parents-first, requeue blocked), plus

the human digest. Execute every action, record outcomes, re-run next, repeat until

done_for_now. Then present the digest, report, and schedule the cron.

The hard limits that autonomy never overrides: no acting without recorded consent, no disclosure

beyond disclosure_fields, no CAPTCHA/anti-bot bypass, and confirmed_removed only after a

verifying re-scan.

When to Use

• "Remove my (or my family member's) data from data brokers / people-search sites."
• "Opt me out", "delete me from Spokeo/Whitepages/etc.", "clean up after a doxxing."
• "Set up recurring privacy monitoring" (brokers re-list people).
• Checking which brokers still expose someone and why.
• "My number keeps getting spam calls" - phone-led scrub: find where the number is listed, opt

out, register it on the Do Not Call Registry, and re-check on a schedule.

Prerequisites

• python (stdlib only; no extra packages needed for the core engine).
• Optional upgrades (the skill works zero-config without these; setup --auto turns on every

one it detects, reading credentials from the shell env and from $HERMES_HOME/.env so keys

Hermes already loads for its own tools are picked up without re-exporting - each one converts a

class of human tasks into agent actions):

• Cloud browser (recommended default): BROWSERBASE_API_KEY. setup --auto selects it

whenever the key is present, and it is the intended baseline: a real residential-IP cloud

browser **clears soft/managed CAPTCHAs (Cloudflare Turnstile, hCaptcha/reCAPTCHA checkbox) as

normal operation**, so those brokers stay automated (T1) instead of becoming human tasks. This

is not CAPTCHA "solving" - no solver service, no fingerprint spoofing; only interactive/behavioral

("hard") challenges the browser genuinely cannot pass fall back to a human task. Without the key,

the plain agent browser is used and soft-CAPTCHA brokers drop to T2 (human).

• Email automation, two credential-free-or-not options:
• Browser mode (no password): setup --email-mode browser. The agent sends opt-out/CCPA

emails and opens verification links through the operator's logged-in webmail using

browser_exec. Nothing is stored. This requires Hermes to be pointed at the operator's own

logged-in browser, NOT a cloud browser: a headless cloud browser (Browserbase) holds no

webmail session and is itself Cloudflare/DataDome-gated on webmail and on session-bound broker

gates (e.g. PeopleConnect guided-mode). Drive the operator's real Chrome over CDP - launch

chrome --remote-debugging-port=9222 --user-data-dir="$HOME/.hermes/chrome-debug" (a dedicated

debug profile signed into the webmail once, not the Default profile) and attach Hermes's browser

to 127.0.0.1:9222 with /browser connect. $PDD cdp launches this for you (finds Chrome/Chromium/Brave/Edge,

starts it detached on the dedicated profile, prints the CDP endpoint; --check to test, --print

for the command). See references/methods.md -> "Browser backends: scan vs execute".

Falls back to drafts for an email if the inbox isn't reachable.

• SMTP/IMAP (stored creds): EMAIL_ADDRESS + EMAIL_PASSWORD (+ EMAIL_SMTP_HOST /

EMAIL_IMAP_HOST for non-mainstream providers; gmail/outlook/yahoo/icloud/fastmail inferred).

The CLI sends via send-email and reads verify links via poll-verification. The agentmail

skill (per-broker aliases) also counts.

• Google Sheets tracker: the google-workspace skill.
• The scrapling skill for stealth/Cloudflare-protected pages.

How to Run

Run everything through the terminal tool. From this skill's directory:

PDD="python scripts/pdd.py"

The engine stores data under $PDD_DATA_DIR (default $HERMES_HOME/unbroker), written

0600. Run via terminal, not execute_code (that sandbox scrubs env and redacts output, which

breaks reading the dossier).

Quick Reference

| Command | Purpose |

|---|---|

| $PDD setup --auto | Autonomous setup: detect capabilities, pick the most autonomous valid config (no questions) |

| $PDD doctor | Readiness check: config, broker count, and which upgrades are on/available |

| $PDD cdp [--check] [--print] [--port N] | Launch/detect the operator's Chrome over CDP for Phase-2 browser + webmail (dedicated debug profile; the reliable way to send webmail and clear session-bound gates) |

| $PDD intake --full-name "..." [--alias ...] [--email ... --phone ...] [--focus-phone ...] [--city --state] [--prior-location "City,ST"] --consent | Create a consenting subject; captures aliases + multiple emails/phones + prior locations; prints subject_id. Phone-led (spam-call) runs may start from --phone alone + --focus-phone (the number being scrubbed); a missing name is warned, not required |

| $PDD next <subject> | The autonomous loop driver: ordered agent actions right now + human digest + next_wake_at |

| $PDD brokers [--priority crucial] | List the people-search broker database (curated + live) |

| $PDD refresh-brokers | Pull the latest BADBOOL people-search list and the CA Data Broker Registry (next requeues this automatically when the cache is stale) |

| $PDD registry [--search NAME] | State registry coverage (CA ~545 ingested; VT/OR/TX portals surfaced); the DROP/email lane, not scanned |

| $PDD drop <subject> [--filed] | The one-shot legal lever: one CA DROP request deletes from ALL registered brokers; --filed records it |

| $PDD dnc <subject> [--filed] | The spam-call lever: register the subject's US personal numbers on the FTC National Do Not Call Registry (sales calls stop within 31 days, never expires); --filed records it |

| $PDD plan <subject> [--priority crucial] | Per-broker tier + method + search_vectors + the exact fields to disclose |

| $PDD plan <subject> --batch | Reduce view: overlays ledger state, groups brokers by next action (unscanned/unsearchable/found/indirect/blocked/in_progress/human/done/not_found; defunct brokers are excluded and listed under defunct), collapses ownership clusters, orders found cluster-parents-first + emits a tailored parent_playbook, prints next_actions |

| $PDD fanout <subject> [--priority crucial] [--size 5] | Batch brokers into parallel delegate_task subagents (auto for large runs; batches of 5 - 8+ time out) |

| $PDD record <subject> <broker> <state> [--found true] [--evidence JSON] [--disclosed F --channel C] [--reason "..."] | Update the ledger (validated state machine); **auto-stamps next_recheck_at

… (full content is in the download package)