End-to-end B2B outreach toolkit combining bulk cold email, global SMS, Google Maps merchant harvesting and contact validation in one skill. Send enterprisebulk cold email campaigns and global mass SMS with two-way reply support, then monitor full delivery status covering sent, delivered, opened and repliedstates. Harvest Google Maps business data filtered by country, region, radius, industry and keywords to batch collect merchant names, addresses andcontacts. Validate phone numbers (landline, mobile, WhatsApp-registered), email addresses and domains before reaching out to cut bounce rates and cleanseCRM contact lists. Streamline cross-border outreach campaigns for exporters, trading firms, sourcing agents and global sales teams - collect, validate,reach and monitor within a single workflow optimized for B2B cold outreach and overseas client acquisition.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed B2B outreach tool, but it handles API keys unsafely and enables bulk outreach/contact harvesting without enough compliance guardrails.

Install only if you intend to run bulk B2B outreach and can verify that your contact collection, validation, email, and SMS activity complies with applicable consent, privacy, and anti-spam rules. Avoid printing or pasting the API key; prefer an environment variable or protected secret store, restrict ~/.upkuajing/.env permissions, rotate any key that appears in logs or transcripts, and confirm costs before any paid search, validation, send, or top-up action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:77

Finding

API Key File Is Created Without Restrictive Permissions

Content

View full analysis

Dict[str, str]: env_vars = {} if UPKUAJING_ENV_FILE.exists(): with open(UPKUAJING_ENV_FILE, 'r', encoding='utf-8') as f: for line in f: line = line.strip() if not line or line.startswith('#'): continue if '=' in line: key, value = line.split('=', 1) env_vars[key.strip()] = value.strip() return env_vars ``` ### Technical Analysis The Skill stores a bearer API key in plaintext at `~/.upkuajing/.env`, but neither the parent directory nor the file is created with an explicit restrictive permission mode. Effective permissions therefore depend on the user's process umask. For example, a common umask of `022` may result in a directory mode of `0755` and a file mode of `0644`. If the user's home directory and parent path are traversable by other local accounts, the API key may be readable by them. The credential storage is necessary for authenticated platform operations, but unrestricted reliance on ambient umask settings exceeds safe minimum-privilege practice. The code also uses a normal pathname-based write without checking file ownership or rejecting symbolic links before overwriting the credential file. ### Attack Path ...[truncated 1316 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:140

Finding

API Key Can Be Exposed Through Terminal Output and Process Arguments

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Version Is Not Reproducibly Pinned

Content

View full analysis

=0.23.0 ``` The installation instructions execute dependency resolution directly: ```markdown 1. **Check Python**: `python --version` 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The requirement specifies only a minimum version. Consequently, installation can select any later `httpx` release, together with whichever transitive dependency versions satisfy the resolver at installation time. This does not establish that the current `httpx` package is malicious. The security problem is that the installed code is not reproducible or bounded to a reviewed dependency set. A future compromised, incompatible, or unexpectedly changed release could be installed automatically without a corresponding Skill review. No package hashes, lock file, upper version bound, or transitive dependency constraints are provided. ### Attack Path 1. The user follows the Skill instructions and runs `pip install -r requirements.txt`. 2. The package resolver queries the configured Python package index. 3. It selects the newest release satisfying `httpx>=0.23.0`, including unresolved transitive dependencies. 4. If a selected future release or dependency is compromised, the package installation or subsequent import executes attacker-controlled code in the user's Python context. 5. That code inherits the permissions and accessible data of the user running the Skill, potentially including the API key environment variable and local Skill data. This is a supply-chain exposure rather than evidence of a currently malicious dependency. ### Impact Assessment If dependency resolution selects a compromised package, impact may include: - Arbitrary code execution with the invoking user's privileges. - Access to `UPKUAJING_API_K ...[truncated 374 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (296)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform version-checking, local cache reads/writes, and metadata inspection that are not disclosed in the high-level description. Hidden update/telemetry-related behavior can expand the network and file-access surface, which matters in a skill already handling credentials and outbound actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs reading and storing an API key in a local .env file under the user's home directory, explicitly showing commands to inspect it. In an agent-capable environment, this creates credential-access risk because the skill normalizes secret file handling and could expose or mishandle the API key through logs, prompts, or overbroad file permissions.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

This skill requires an API key, stored in ~/.upkuajing/.env:

bash

cat ~/.upkuajing/.env

text

UPKUAJING_API_KEY=your_api_key_here

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The function manages an API key by checking for and later storing it in a local .env-style file under the user's home directory. Secrets in plaintext files are at risk of disclosure through weak filesystem permissions, backups, accidental sharing, or other local compromise, and this skill's outreach context increases sensitivity because the key may authorize bulk messaging or account actions.

Content

Scanner excerpt · scripts/auth.py (reported line 32)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Reading secrets from a local .env file is part of credential handling, and combined with the surrounding logic it normalizes plaintext secret storage. While reading a secret is expected functionality, the broader pattern still creates exposure if the file is accessible to other users or processes.

Content

Scanner excerpt · scripts/auth.py (reported line 36)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The code writes the issued API key directly to a .env file in plaintext without setting restrictive permissions. If another local user, process, backup system, or malware can read that file, the attacker could obtain the key and abuse the associated account for messaging, billing, or data access.

Content

Scanner excerpt · scripts/auth.py (reported line 85)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 92)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares capabilities that involve reading environment variables, reading/writing local files, and making network requests, but it does not constrain tool scope with an explicit permissions or allowed-tools declaration. In a skill that handles API keys, payment/top-up flows, and outbound communications, missing scope boundaries increases the chance of unintended credential access, local data exposure, or overbroad execution by an agent runtime.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list is very broad and includes generic outreach-related phrases that could cause the skill to activate for loosely related requests. In an agent system, overbroad activation is dangerous because this skill can access credentials, contact data, external APIs, and fee-incurring operations, increasing the chance of unintended spam, scraping, or billing actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill facilitates harvesting merchant/contact data and sending bulk cold outreach, but the description does not clearly warn about privacy, anti-spam, consent, and jurisdiction-specific compliance risks. In this context, omission is significant because the primary use case directly touches regulated personal/business contact data and mass communications, making misuse more likely and more harmful.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_send.py:31

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_task_list.py:29

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/mail_task_record_list.py:30

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sms_send.py:25

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sms_task_list.py:28

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sms_task_record_list.py:30