Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for sensitive-file-audit
Inspiration
A NAS is where files go to be forgotten. Scans, downloads and backups pile up, and over time passports, bank statements, password exports and .env files end up in shared or old folders. With my background in cybersecurity and my work with the Young Cyber Knights Foundation, I have seen how often the real risk is simply not knowing what is sitting where. I wanted a tool that answers that question without handing private files to anyone.
What it does
Sensitive File Audit scans only the folders you authorize and finds likely sensitive files. It reads documents in read-only mode, groups duplicate copies, and shows a masked risk report with no secret values. After you approve a plan, it moves the files you chose into a review folder and tags them. It never deletes, overwrites or renames anything.
How I built it
I built it as a Skill for UGREEN AI NAS using the UGOS Skill Creation Tool. The Skill makes four delegations: three to file-agent (candidate discovery, duplicate scanning, approved moves and tags) and one to document-agent (read-only extraction and OCR). Credential, key and environment files are screened by name and location and their contents are never opened. Every move and tag goes through the platform approval flow.
What I learned
- A good security tool should know what not to read. Choosing not to open secret files made the design safer and simpler.
- The official checker is strict. My first draft failed with six errors (wrong headings, missing delegation states, an unsupported root file). Fixing them forced me to handle every outcome: completed, failed, cancelled, waiting for the user, and waiting for approval.
- Staying within the supported capabilities matters more than adding clever features.
Challenges
- No NAS in Round 1. I could validate the package against the official checker, but I could not run it on real hardware, so approval prompts and OCR quality are still untested.
- Detection limits. Name-based screening can miss sensitive files with ordinary filenames, so the report is a screening aid, not a guarantee.
- Honest claims. I had to word the privacy promises carefully. The Skill itself calls no external services, but which model the platform's document expert uses is decided by the platform.
What's next
If I become a Finalist, I will test on the real NAS with synthetic data only: planted fake IDs, statements, .env and key files, duplicate documents, and an empty or inaccessible folder as the edge case.
AI assistance: Claude (Anthropic) helped with requirements research, drafting the Skill package and grammar checks. The idea, the safeguards and the final review are my own.
Built With
- agent-skills
- ai-agent
- ai-nas
- cybersecurity
- data-privacy
- duplicate-detection
- file-management
- local-first
- nas
- ocr
- privacy
- security
- ugos
- ugreen
