All-in-one B2B lead generation toolkit aggregating customs trade intelligence, global company deep due-diligence and LinkedIn professional network data into asingle workflow. Analyze HS code market distribution, trade trends and company trade-share rankings to size any product market. Profile a singlecompany's real trade scale, partners, products and ports from 220+ countries of customs records. Pull macro country-level trade overviews, top buyersand suppliers and US import statistics. Run deep company background checks covering employees, shareholders, ultimate beneficial owners (UBO) anddecision-makers, and map LinkedIn professional networks including colleagues, alumni, career histories and education backgrounds. Built for exporters,sourcing agents, sales teams and B2B prospecting specialists to discover overseas buyers, validate suppliers and accelerate cross-border customeracquisition through combined customs-data, corporate-database and LinkedIn intelligence.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.1

Overview

This appears to be a real paid B2B lead-generation integration, but it handles API keys and personal/contact data in ways users should review carefully before installing.

Install only if you are comfortable with a paid lead-generation tool that can retrieve professional/contact data and store results locally. Do not print ~/.upkuajing/.env into chats or logs; treat the API key as a secret, use a virtual environment, restrict file permissions on ~/.upkuajing, and ensure your use of people/contact data complies with applicable privacy and outreach laws.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:72

Finding

Credential Disclosure Through Full Environment File Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:91

Finding

API Key File Is Created Without Explicit Owner-Only Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Allows Unreviewed Future Releases

Content

View full analysis

=0.23.0 ``` Related installation instruction in `SKILL.md`: ```markdown 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The requirement accepts every future `httpx` release greater than or equal to version 0.23.0. As a result, two installations performed at different times can resolve to different code without any change to the audited project. No upper bound, exact version pin, lock file, or package hash is provided. This prevents reproducible dependency resolution and allows unreviewed future versions to enter the Skill environment. Because `httpx` is imported by `scripts/common.py` and `scripts/version_check.py`, any installed package code executes within the Python process and inherits that process’s access to files, environment variables, API credentials, and network connectivity. The package name is legitimate and there is no evidence that the currently resolved package is malicious. The confirmed issue is the unsafe dependency policy, which creates a future supply-chain exposure. ### Attack Path 1. A future release accepted by `httpx>=0.23.0` is compromised, malicious, or otherwise unsafe. 2. A user follows the documented command `pip install -r requirements.txt`. 3. Pip resolves and installs the unreviewed release. 4. The Skill imports `httpx` from `common.py` or `version_check.py`. 5. Malicious package initialization or runtime code executes with the user’s Python privileges. 6. The code may read accessible files or environment variables, including `UPKUAJING_API_KEY`, and communicate over the network. This path depends on compromise or unsafe behavior in a future accepted dependency release; the repository does not co ...[truncated 654 chars]

Remediation

View remediation

``` Then generate a fully resolved, hash-locked requirements file and install it with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (105)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks, local cache management under the user's home directory, and reading local metadata are additional behaviors outside the user-facing lead-gen description. While not inherently malicious, under-disclosed local persistence and external calls increase the attack surface and make it harder for users to understand where data is stored and when network communication occurs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Remote version checks, local cache management under the user's home directory, and reading local metadata are additional behaviors outside the user-facing lead-gen description. While not inherently malicious, under-disclosed local persistence and external calls increase the attack surface and make it harder for users to understand where data is stored and when network communication occurs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks, local cache management under the user's home directory, and reading local metadata are additional behaviors outside the user-facing lead-gen description. While not inherently malicious, under-disclosed local persistence and external calls increase the attack surface and make it harder for users to understand where data is stored and when network communication occurs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks, local cache management under the user's home directory, and reading local metadata are additional behaviors outside the user-facing lead-gen description. While not inherently malicious, under-disclosed local persistence and external calls increase the attack surface and make it harder for users to understand where data is stored and when network communication occurs.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs reading and storing an API key in a local .env file under the user's home directory, and even suggests displaying that file with a shell command. This creates credential-exposure risk through logs, agent output, overly broad file access, or accidental disclosure of the secret to downstream tools or users.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

This skill requires an API key, stored in ~/.upkuajing/.env:

bash

cat ~/.upkuajing/.env

text

UPKUAJING_API_KEY=your_api_key_here

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

- **Parameters**: See [Error Report API](references/skill-error-report-api.md)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

- **Parameters**: See [Error Report API](references/skill-error-report-api.md)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 45)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 49)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 105)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Writing a newly issued API key to a plaintext .env file creates a local secret-at-rest risk. If the home directory, backup system, logs, or filesystem permissions are weak, the key can be recovered and abused to impersonate the user against the remote API.

Content

Scanner excerpt · scripts/auth.py (reported line 98)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill declares executable behavior involving environment access, filesystem reads/writes, and network use, but does not define any explicit tool scope or allowed-tools boundaries. That increases the chance the agent can invoke more capabilities than users expect, especially since the skill also instructs reading local credential files and making external API/payment requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly collects and analyzes employee lists, shareholders/UBO, decision-makers, colleagues, alumni, and work/education history, but it does not present an upfront privacy warning or clear usage constraints. In this context, the absence of privacy safeguards is more dangerous because the skill is designed for lead generation and network mapping, which can enable profiling, targeting, or misuse of personal/professional data at scale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is extremely broad and overlaps with common business, recruiting, sourcing, and research requests. Overbroad activation criteria can cause the skill to be selected in contexts where users did not intend to invoke paid data access, personal-data lookup, or due-diligence operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

### Account Top-up
When API response indicates insufficient balance:
1. Create top-up order (`auth.py --new_rec_order`)
2. Send the payment page URL to the user, guide them to open & pay; proceed after they confirm success.

### Get Account Information

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly exposes fields such as person_contact_show and counts of phone, email, website, and WhatsApp contacts, yet provides no privacy, lawful-basis, consent, or acceptable-use constraints. In the context of a B2B lead-generation and due-diligence skill, this materially increases the risk of mass harvesting, profiling, and misuse of personal/contact data in ways that may violate privacy, anti-spam, or data-protection laws.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This API reference explicitly supports filtering for company contact data and the existence of employee/core-member contact information, including phone, email, WhatsApp, social accounts, and a sample employee contact field. In a lead-generation and LinkedIn-enrichment skill, that materially increases the risk of privacy-invasive profiling, unsolicited outreach, scraping abuse, and potential misuse of personal data without any documented consent, legal basis, or handling restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This API reference documents bulk retrieval of a person's colleague information tied to company and person identifiers, but provides no privacy notice, lawful-use constraints, consent requirements, or data-handling guidance. In a lead-generation and due-diligence skill, that omission materially increases the risk of misuse for profiling, unsolicited outreach, or unauthorized processing of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API documentation explicitly allows sending request parameters, response payloads, and exception context to an external error-reporting endpoint. In this skill’s lead-generation and due-diligence context, those fields can easily contain personal data, company-sensitive information, API outputs, and identifiers, so forwarding them without an explicit user warning, strict minimization rules, or opt-in creates a real data-leakage risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module title, descriptions, CLI help text, and user-facing messages are all hard-coded in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file adds account creation, billing, and pricing-management capabilities to a skill advertised as B2B lead generation and due diligence. That scope expansion increases the blast radius because invoking the skill can modify credentials and payment state, which is more sensitive than ordinary data retrieval and can surprise users or downstream agents.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196