B2B 线索生成聚合工具，将海关贸易情报、全球企业深度背调与 LinkedIn 职业人脉数据整合为统一工作流。分析 HS 编码的市场分布、贸易趋势与企业贸易占比以评估产品市场规模；基于 220+ 国家海关记录剖析单个公司的真实贸易规模、伙伴、产品与港口；获取宏观国家级贸易概览、Top 买家/供应商与美国进口统计；开展公司深度背调（员工、股东、最终受益人UBO、决策人）并绘制 LinkedIn 职业人脉图谱（同事、校友、履历与学历）。帮助出口商、采购代理、销售团队与 B2B获客专家发现海外买家、验证供应商、加速跨境客户开发，适用于外贸找客户、供应商寻源与销售线索挖掘。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:56 AM UTC
• Version: 1.0.1

Overview

This skill mostly matches its stated B2B search purpose, but it exposes API-key and person-data handling risks that users should review before installing.

Install only if you are comfortable with a paid third-party B2B/person-search API, local storage of API keys and search results, and processing of professional contact/person data. Avoid printing the .env file, restrict file permissions yourself, clean task_data when finished, and confirm each billable or error-reporting action before it runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:70
• Finding: Credential File Contents May Be Exposed Through Documented Inspection Command## Vulnerability Details **File Location**: `SKILL.md`, lines 70–75 **Vulnerability Type**: Plaintext credential disclosure **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash cat ~/.upkuajing/.env ``` ```text UPKUAJING_API_KEY=your_api_key_here ``` ### Technical Analysis The documented command prints the entire contents of `~/.upkuajing/.env`, although the Skill only needs to determine whether `UPKUAJING_API_KEY` exists. A shared environment file may contain additional credentials or sensitive configuration unrelated to this Skill. Output from the command may become visible in terminal history, execution logs, captured Agent tool output, or conversation context. This exceeds the minimum privilege required to authenticate API requests because checking for one variable does not require revealing any variable value. The reviewed implementation does not automatically transmit the contents of this file to another destination. The vulnerability is an unnecessary local disclosure caused by following the Skill instructions. ### Attack Path 1. A user or another application stores `UPKUAJING_API_KEY` and possibly other secrets in `~/.upkuajing/.env`. 2. An Agent or user follows the documented environment-check procedure. 3. The `cat` command prints every key and value in the file. 4. The output is retained in terminal logs, Agent execution records, or conversation context. 5. Anyone with access to those records may recover the exposed credentials. ### Impact Assessment An attacker who can access the captured output may obtain the UpKuaJing API key and any unrelated secrets stored in the same file. A stolen API key could permit authenticated, paid API requests within the privileges and balance associated with the account. This issue does not directly grant operating-system privilege escalation.
• Remediation: ## Remediation Suggestions - Remove the instruction to print the complete `.env` file. - Check only whether `UPKUAJING_API_KEY` is present and non-empty. - Never display the full key; if diagnostic output is necessary, show only a short redacted fingerprint. - Prefer the process environment over a plaintext credential file. - Ensure Agent tool output and command logs never contain credential values. - Update error messages so they identify the configuration location without instructing users to reveal its contents.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:98
• Finding: API Key and Persisted Lead Data Lack Explicit Restrictive File Permissions## Vulnerability Details **File Locations**: `scripts/auth.py`, lines 98–101; `scripts/common.py`, lines 449–482 **Vulnerability Type**: Insecure local storage of credentials and potentially sensitive business or personal data **Risk Level**: Medium **Vulnerable Code Snippets**: ```python try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n") ``` ```python def save_task_meta(task_id: str, meta: Dict[str, Any]) -> None: meta_file = get_task_meta_file(task_id) ensure_task_dir(task_id) with open(meta_file, 'w', encoding='utf-8') as f: json.dump(meta, f, ensure_ascii=False, indent=2) ``` ```python def append_result_data(task_id: str, data_list: list) -> None: result_file = get_task_result_file(task_id) ensure_task_dir(task_id) with open(result_file, 'a', encoding='utf-8') as f: for item in data_list: f.write(json.dumps(item, ensure_ascii=False) + '\n') ``` ### Technical Analysis The API key is written to `~/.upkuajing/.env`, while query metadata and results are written under `task_data/`. The code does not explicitly create the credential directory with mode `0700` or files with mode `0600`. Their effective permissions therefore depend on the process umask and existing parent-directory permissions. Search results may contain employee, shareholder, education, employment, company, and professional-network information. Query metadata can also disclose investigation targets and search criteria. These files are retained without a defined expiration or cleanup mechanism. The task identifier is validated as a UUID, which mitigates direct path traversal. The issue is therefore not arbitrary file writing, but insufficient confidentiality controls and indefinite local retention. ### Attack Path 1. The Skill runs in an environment with a permissive umask or broadly accessible project directory. 2. `auth.py` ...[truncated 981 chars]
• Remediation: ## Remediation Suggestions - Create `~/.upkuajing` and sensitive task directories with mode `0700`. - Create credential, metadata, and result files with mode `0600`, independent of the process umask. - Use secure atomic creation, such as opening a newly created file with exclusive flags and setting its mode before writing sensitive data. - Verify that existing files are regular files owned by the current user before overwriting them. - Prefer an operating-system credential store or secret manager for the API key. - Add configurable retention periods and a secure cleanup command for task results. - Clearly disclose that lead and professional data are persisted locally. - Avoid storing complete query parameters when they are unnecessary for task resumption.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unbounded Dependency Version Reduces Installation Integrity and Reproducibility## Vulnerability Details **File Location**: `requirements.txt`, line 1 **Related Location**: `SKILL.md`, lines 24–25 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low **Vulnerable Code Snippet**: ```text httpx>=0.23.0 ``` The documented installation process is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency constraint accepts any `httpx` version from 0.23.0 onward. This makes installation non-reproducible and permits future major or otherwise incompatible releases to be selected without review. No lock file or package hashes are supplied to verify the resolved artifacts. The package name is legitimate and there is no evidence of dependency confusion or a currently malicious package. The risk arises from unconstrained future resolution and lack of artifact integrity controls rather than from a confirmed malicious dependency. ### Attack Path 1. A user follows the documented `pip install` command. 2. The package resolver selects the newest version satisfying `httpx>=0.23.0`. 3. A future compromised, vulnerable, or incompatible release is downloaded from the configured package index. 4. Installation or later import executes that dependency within the user’s Python environment. 5. The dependency receives the same local privileges as the Python process and participates in authenticated network requests. This path requires compromise or unsafe evolution of the dependency supply chain; no such compromise was identified during the audit. ### Impact Assessment A malicious dependency release could execute code with the privileges of the installing or running user, access readable local files and environment variables, and observe API request data. A merely incompatible release could cause availability failures or unexpected network behavior. The current evidence supports a supply-chain-hardening issue rather than active malicious behavior.
• Remediation: ## Remediation Suggestions - Pin `httpx` to a specifically reviewed version or a narrowly bounded compatible range. - Generate and commit a lock file containing all transitive dependency versions. - Use package hashes and require hash verification during installation. - Review and update dependency pins through a controlled maintenance process. - Install dependencies inside an isolated virtual environment rather than the system Python environment. - Run dependency vulnerability and provenance checks in continuous integration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (101)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 代码的主功能与声明的业务能力明显不一致。声明描述的是面向终端用户的数据分析/线索生成能力，而该代码片段实际是配套的认证与计费管理模块（auth.py），调用的接口也都是 /agent/auth/create、/agent/auth/info、/agent/auth/pay/url、/agent/api/list 等认证、支付、定价相关端点。它没有实现任何HS编码分析、贸易地区分布、进出口趋势、公司贸易伙伴分析、企业搜索、股东UBO查询、人物履历教育查询或LinkedIn关系图谱构建。虽然这类认证代码可能是聚合技能的支持组件，但就“该代码块实际做什么”而言，其能力与声明用途不匹配，且包含未在声明中体现的账户/支付/定价管理能力。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是面向B2B线索生成、贸易情报分析、企业尽调和LinkedIn人脉查询的业务能力；而实际代码并未执行任何贸易数据检索、公司搜索、人物搜索、关系图谱分析或尽调逻辑。其唯一功能是向平台上报Agent调用Skill时发生的异常，属于运维/监控支持脚本，而非描述中的业务功能。这个差异是主目的层面的明显不一致，因此应判定为描述与代码行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个覆盖贸易分析、企业背调和LinkedIn关系图谱的多功能工具集；但当前提供的代码块只做 company list 搜索，且数据源固定为 depth_company。它没有实现任何海关贸易、HS编码、进出口趋势、买家/供应商排名、人员/股权穿透或LinkedIn关系网络相关逻辑。虽然“全球企业搜索/找公司列表”属于声明中的一小部分，但代码的实际主功能明显比描述狭窄得多，因此描述不能准确代表该代码块的实际行为，构成不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 代码的实际功能与声明的B2B线索生成、贸易分析、企业背调和LinkedIn人脉数据处理完全无关。该代码块仅实现技能自身的版本检查与升级提醒，包括访问本地文件系统（~/.upkuajing/version_cache.json、SKILL.md）、向服务端/agent/api/skills/version发起HTTP请求、以及打印升级通知。这属于与声明目的 materially different primary purpose 的情况，应判定为明显不匹配。

Credential Access

High

• Category: Privilege Escalation

Content

本技能需要 API 密钥，存储在 `~/.upkuajing/.env`：
```bash
cat ~/.upkuajing/.env
```
```
UPKUAJING_API_KEY=your_api_key_here

• Confidence: 95% confidence
• Finding: The skill instructs reading a local .env file with `cat ~/.upkuajing/.env`, which exposes credential material in plaintext to the agent/session. Any workflow that encourages direct file contents display increases the chance of secret leakage to logs, downstream tools, or the model itself, especially since the skill also has networked capabilities.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: The script writes a newly issued API key directly to a plaintext .env file under the user's home directory without showing any permission hardening or secure-secret storage. If the file is readable by other local users, included in backups, or accidentally exposed by tooling, the credential could be stolen and used to access the paid API account.

Credential Access

High

• Category: Privilege Escalation

Content

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares capabilities that involve environment variables, local file access, and network/API operations, but it does not define an explicit tool scope such as allowed-tools or permissions. That makes the effective privilege boundary unclear and increases the chance the agent can read secrets, write local state, or make outbound requests beyond what a user expects.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list is very broad and overlaps with common business, people-search, and outreach-related requests, which can cause the skill to activate in situations the user did not clearly intend. In a skill that can query personal/professional data and access paid APIs, over-broad routing increases the risk of unauthorized data retrieval or unnecessary charged actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly supports collecting and analyzing employee lists, shareholders/UBO, decision-makers, and LinkedIn relationship data, but the description does not warn about privacy, personal-data handling, or appropriate-use limits. In this context, the omission is more dangerous because the skill is aimed at lead generation and profiling of identifiable individuals, which can enable privacy abuse, stalking, or noncompliant data processing.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The API reference explicitly exposes filters and indicators for company and employee contact data, including valid phone/email/website status and existence of core member contact information, but provides no privacy, legal-use, consent, or data-handling restrictions. In a B2B lead-generation and due-diligence skill, this materially increases the risk of scraping, profiling, unsolicited outreach, and misuse of personal/business contact data at scale.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API reference explicitly documents filtering and enumeration of personal contact-related attributes such as phone, email, WhatsApp, social presence, gender, and named individuals, but provides no privacy, consent, acceptable-use, or legal-compliance constraints. In a lead-generation and due-diligence skill, this materially increases the risk of targeted profiling, bulk contact harvesting, and misuse of personal data for unsolicited outreach or surveillance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly exposes filters and response fields for personal and company contact data, including phone, email, WhatsApp, website validity, and a displayed employee contact. In a lead-generation and LinkedIn-enrichment context, this materially increases privacy, profiling, and outreach-abuse risk because the skill normalizes collection and use of contactable personal data without any warning, lawful-basis guidance, access restrictions, or handling requirements.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly supports filtering for the existence of phone, WhatsApp, email, website, and social contact data, but provides no privacy, lawful-basis, or acceptable-use constraints. In a lead-generation and LinkedIn people-search skill, this materially increases the risk of doxxing, unsolicited outreach, scraping abuse, and processing of personal data without proper compliance controls.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The response schema exposes personal profile attributes such as gender, country, job history counts, and counts of phone/email/social accounts without any warning or safeguards for sensitive-data handling. Given the skill's stated purpose of lead generation, due diligence, and professional network mapping, these fields can enable profiling and targeted contact harvesting at scale.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The API documentation explicitly supports transmitting request parameters, response data, and exception context to a remote error-reporting endpoint, but it does not warn users that these fields may contain sensitive business data or personal data. In this skill’s context—trade intelligence, company due diligence, and LinkedIn/personnel data—those payloads can include highly sensitive commercial information or personal identifiers, increasing the risk of unintended data disclosure during troubleshooting.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 75% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 80% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: 该技能清单描述聚焦于海关贸易分析、企业背调和 LinkedIn 人脉数据获取，没有提到账户资金管理或支付相关操作。`new_rec_order()` 直接调用 `/agent/auth/pay/url` 创建充值订单，属于平台账户充值能力，而不是完成线索生成分析所必需的能力。

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196