In unified_inventory players can see private skins.

[Lourens-Rich]

$ cat meta/player_Pirate_1.txt 
Lil Ghast
Blitzfan
CC 0 (1.0)

[SmallJoker]

For performance reasons, the formspec of the pages in unified_inventory are set directly when the mod gets loaded. Loading the formspec string from a variable is the fastest you can achieve. Filtering these by player means re-building the formspec for each page / for each click or generating and caching all pages for each player when they join.

[bell07]

The unified_inventory is stateless and therefore bulky for dynamic views, but it is not true it is not possible to get something dynamic. In page registration the get_formspec = function(player) is called each time the page is requested, some dynamic is possible like selected skin preview on the 'skins' overview page.

Because I do not use the unified_inventory I did not implemented the "full solution", just applied the u_skins pages implementation. Maybe anyone like to rewrite it away from multiple hidden static pages to one dynamic like in other inventories.

As I seen the issue I just not implemented any skin selection filter, therefore all skins (private and public) are visible in UE.

But afterwards the beter workaround seems to be to select the public skins only and hide all private for all players. It is 1 line-change. Should I do it? In this case the private players skins are not accessable trough unified_inventory anymore. If needed maybe an other mod can be developed like wardrobe, an chat-command or an "Custom skin (like in character_creator)" can be implemented to get the private skins accessable beside the UE.

[SmallJoker]

@bell07 According to the issue everybody can use the private skins, which is a bug. Not showing them up in the list won't be enough then, as this leak could still be used by a modified client & CSM.

[bell07]

The bug is solved. Private skins are not visible anymore in UE.
To implement the support for private skins in UE a new enhancement issue created: #3