域名有效性检查，验证企业网站域名有效、无效状态。帮助销售团队、市场人员和研究人员检查公司域名、提升邮件触达率——是 CRM数据清洗、销售线索验证、供应商核验、邮件列表清洗的必备工具，适用于外贸邮件群发前清洗、招聘背调与采购商核实。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:35 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches a paid domain-validation API wrapper, but it also bundles sensitive account, credential-storage, recharge-order, telemetry, and automatic update-check behavior that users should review carefully before installing.

Install only if you trust the Upkuajing service and are comfortable with the skill managing a local API key file, contacting the vendor API, creating recharge orders when directed, and sending diagnostic reports after confirmation. Avoid reporting sensitive customer data in error context, protect ~/.upkuajing/.env, and review account/billing actions before approving them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while its documented behavior clearly includes reading and writing local files, accessing environment-backed secrets, and making network calls. This hidden capability expansion weakens least-privilege review and can cause an agent or user to authorize a skill without understanding that it can access credentials, persist data locally, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The published purpose is domain validation, but the skill also performs account lifecycle and platform operations such as API key issuance, local credential storage, pricing lookup, recharge order creation, exception reporting, and update checks. That mismatch is dangerous because users may invoke a seemingly narrow validation tool while unintentionally granting it authority to manage billing, handle credentials, and send data to external endpoints.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documentation extends a domain-checking skill into account management and operational workflows, including key provisioning, recharge ordering, and incident reporting. This broadens the trust boundary and increases the chance that operational or sensitive account actions are triggered in a context where the user expected only passive domain analysis.

Intent-Code Divergence

Low

• Confidence: 74% confidence
• Finding: The documentation says paid actions require prior notice and explicit confirmation, yet nearby instructions allow automatic key-application behavior that may lead to downstream billable use without a strong, consistent approval boundary. This inconsistency can cause agents to take financially relevant setup actions under ambiguous consent rules.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements account management, API key issuance, payment order creation, and pricing queries, which materially exceed the declared domain-validation purpose of the skill. This capability mismatch is dangerous because users may invoke a seemingly low-risk domain-checking skill that can also manage credentials and initiate billing-related actions, increasing the chance of surprise side effects and misuse.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The script can create recharge/payment orders even though the advertised skill is for domain validity and security checks. Billing functionality embedded in an unrelated skill creates an unjustified financial-action surface and could lead to unauthorized or unexpected charges if invoked by users or higher-level agents without clear awareness.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code retrieves and returns account identifiers and balance information that are unrelated to domain validation. Exposing account metadata in a mismatched skill increases privacy and reconnaissance risk by making sensitive commercial/account details available through an unexpected interface.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: Querying API pricing information is a commercial/account capability unrelated to the skill's stated purpose. While not directly destructive, it broadens the information exposure and capability surface of the skill beyond what users would reasonably expect from a domain-validation tool.

Intent-Code Divergence

High

• Confidence: 94% confidence
• Finding: The module self-describes as authentication management for key application and recharge, which conflicts with the skill's declared domain-validation use case. Such mislabeling undermines informed consent and trust boundaries, making it easier to hide sensitive operations such as credential issuance and payment actions inside an apparently harmless skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file’s behavior materially differs from the declared skill purpose: instead of domain validation, it performs remote exception reporting and transmits supplied parameters to an external endpoint. This kind of capability mismatch is dangerous because it can hide unexpected data egress paths and make operators invoke the skill under incorrect trust assumptions, especially when the transmitted context may contain operational or user data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module adds remote version-checking and upgrade prompting behavior that is unrelated to the stated domain-validation purpose of the skill. While not overtly malicious, it introduces extra network-capable functionality and side effects (telemetry-like contact with a server and user-visible upgrade messaging) that expand the attack surface and can be abused if the configured API endpoint is untrusted or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code automatically sends the skill name to a remote API for version lookup, which is capability creep relative to a domain-checking skill and constitutes undisclosed outbound metadata transmission. The data sent is limited, so impact is not severe by itself, but the hidden network behavior reduces transparency and may leak tool usage information to an external service.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document explicitly encourages reporting `requestParams`, `responseData`, and detailed `context` to a central error-report API, but it does not require user notice, consent, minimization, or clear redaction guarantees beyond a brief claim that sensitive fields are auto-masked. In a domain-validation skill, these fields can plausibly contain customer email lists, queried domains, API outputs, or stack traces with operational details, creating avoidable privacy leakage and secondary exposure if over-collected or improperly masked.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The script writes a newly issued API key to a local .env file as a side effect, without an upfront interactive warning before the write occurs. Storing credentials automatically can surprise users, place secrets in insecure locations, and increase the risk of accidental disclosure through backups, version control, or permissive filesystem settings.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script sends request metadata and a free-form context field to a remote API without any visible consent, redaction, or disclosure controls. If context includes stack traces, identifiers, customer data, or secrets, this creates a privacy and data-leakage risk through exception telemetry.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The version check performs an automatic network request and transmits the skill name without a clear user-facing warning or consent at the call site. This is a real security/privacy weakness because silent outbound communication can surprise users, violate least astonishment, and expose environment/tooling metadata to external infrastructure.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs checking a local .env file for an API key, which means it is designed to access locally stored credentials outside the immediate task input. Credential discovery and handling are sensitive operations; if misused or overly broad, they can expose secrets, enable unauthorized API use, or normalize unsafe secret storage practices.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: The skill not only accesses credentials but can also obtain a new API key and automatically write it into ~/.upkuajing/.env. Writing secrets to local plaintext-style environment files increases the risk of credential leakage through filesystem exposure, backups, logs, or later unintended reads by other tools.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 72% confidence
• Finding: The code reads the existing .env file and parses out the API key value, handling secrets directly in plaintext. Although done for duplicate-checking rather than exfiltration, plaintext secret access in an unrelated skill raises credential exposure risk, especially if the file is broadly readable or later logged, reused, or mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: This line writes a newly issued API key in plaintext to a .env file, creating a persistent local secret that may be exposed via filesystem access, backups, or accidental inclusion in tooling and repositories. Because the skill is presented as a domain-validation tool, users may not anticipate this credential-storage behavior, which makes the side effect more dangerous.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is only lower-bounded (httpx>=0.23.0), which allows installation of any future major or minor version. This can introduce supply-chain risk, unexpected vulnerable releases, or breaking behavior changes that affect the skill at install or runtime. In a network-focused skill that validates domains and likely makes outbound HTTP requests, dependency integrity matters because the package sits on a sensitive execution path.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: Using require_auth=False for the key-creation request establishes an unsafe default around a sensitive operation. In the context of a skill unrelated to authentication management, this further increases surprise and misuse potential because credential provisioning is exposed through a broader, less expected interface.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: Using require_auth=False for the key-creation request establishes an unsafe default around a sensitive operation. In the context of a skill unrelated to authentication management, this further increases surprise and misuse potential because credential provisioning is exposed through a broader, less expected interface.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196