T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:45- Finding
API Credential Disclosure Through Instructed File Output
- Content
View full analysis
- Remediation
View remediation
Security audit
域名有效性检查，验证企业网站域名有效、无效状态。帮助销售团队、市场人员和研究人员检查公司域名、提升邮件触达率——是 CRM数据清洗、销售线索验证、供应商核验、邮件列表清洗的必备工具，适用于外贸邮件群发前清洗、招聘背调与采购商核实。
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a domain-checking tool, but it needs review because it can expose or persist API keys and performs extra account, payment, reporting, and update-check activity.
Review this skill before installing. Use it only if you trust the vendor API and are comfortable with paid requests, local API-key storage, account/recharge helper commands, optional error reporting, and daily update checks. Do not let an agent print `~/.upkuajing/.env`; check only whether the key exists, and ensure any stored key file is private to your user account.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth.py:62- Finding
API Key Persisted Without Enforced Owner-Only Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Dependency Version Introduces Supply-Chain Risk
- Content
View full analysis
=0.23.0 ``` The installation instructions execute: ```bash pip install -r requirements.txt ``` ### Technical Analysis The lower-bound-only constraint permits installation of any current or future `httpx` version accepted by the resolver. Transitive dependencies are also not locked, and no package hashes are provided. As a result, installation is not reproducible and the effective dependency code can change after the Skill has been audited. A compromised future release, compromised transitive dependency, unsafe package index, or incompatible major release could be selected without any project change. No evidence was found that the current dependency name is a typosquat or intentionally malicious. The finding concerns unsafe dependency resolution and supply-chain hardening. ### Attack Path 1. A user follows the documented installation command. 2. `pip` resolves the newest package versions satisfying `httpx>=0.23.0`. 3. A newly compromised, malicious, or incompatible release is selected from the configured package index. 4. Package installation or later import executes the affected dependency code. 5. That code runs with the permissions of the user invoking the Skill and may access the API credential and domain data available to the process. ### Impact Assessment A compromised dependency would execute within the Skill's Python process and inherit its filesystem, environment, and network privileges. It could potentially read `UPKUAJING_API_KEY`, inspect `~/.upkuajing`, modify user-accessible files, alter requests or responses, and transmit processed domain data. Actual exploitation depends on a malicious or compromised dependency entering the resolution chain; no such package was confirmed during this static audit. ]]>- Remediation
View remediation
other
Note
- Location
scripts/version_check.py:119- Finding
Automatic Version Check Sends Undisclosed Usage Metadata
- Content
View full analysis
bool: """ 执行版本检测并打印升级提示（如果有新版本） 每天第一次 API 调用时触发，非阻塞 Returns: True if an update is available, False otherwise """ global _CHECKED_FLAG # 进程内检查，避免重复检测 if _CHECKED_FLAG: return False _CHECKED_FLAG = True skill_name = get_skill_name() # 检查是否需要检测 if not is_check_needed(skill_name): return False current_version = get_skill_version() latest_version = check_skill_version(skill_name, api_base_url) if latest_version and latest_version != current_version: # 标记已检查并打印升级提示 mark_checked(skill_name, latest_version) notify_upgrade(skill_name, current_version, latest_version) return True # 即使没有新版本也标记已检查，避免重复检测 if latest_version: mark_checked(skill_name, latest_version) return False ``` The check is automatically invoked before API requests: ```python # 版本检测 check_and_notify(API_BASE_URL) ``` The network request transmits the directory-derived Skill name: ```python url = f"{api_base_url}/agent/api/skills/version" headers = {"Content-Type": "application/json"} with httpx.Client(timeout=10.0) as client: response = client.post(url, json={"name": skill_name}, headers=headers) ``` ### Technical Analysis Every call through `make_request()` first invokes the version-check mechanism. On the first qualifying invocation each day, it sends the Skill name to the vendor endpoint and writes state to `~/.upkuajing/version_cache.json`. The Skill name is derived from the installation directory rather than from a fixed declared identifier. This may expose a locally assigned directory name or artifact identifier. The additional reques ...[truncated 1424 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a domain validation utility, yet it reportedly performs version checking, local cache maintenance, and remote update queries. While version checks can be legitimate, they are security-sensitive when undeclared because they create extra network traffic and local state that users do not expect from a validation task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is described as a domain validation utility, yet it reportedly performs version checking, local cache maintenance, and remote update queries. While version checks can be legitimate, they are security-sensitive when undeclared because they create extra network traffic and local state that users do not expect from a validation task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a domain validation utility, yet it reportedly performs version checking, local cache maintenance, and remote update queries. While version checks can be legitimate, they are security-sensitive when undeclared because they create extra network traffic and local state that users do not expect from a validation task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is described as a domain validation utility, yet it reportedly performs version checking, local cache maintenance, and remote update queries. While version checks can be legitimate, they are security-sensitive when undeclared because they create extra network traffic and local state that users do not expect from a validation task.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The documentation explicitly instructs reading the credential file at ~/.upkuajing/.env, which is a direct credential access pattern. In the context of a domain validation skill, requesting or displaying raw secret material is more dangerous because it is unnecessary for the primary task and can expose API keys to the model, logs, or unintended outputs.
- Content
使用此技能需要API密钥。API密钥保存在
~/.upkuajing/.env文件中：bash cat ~/.upkuajing/.env文件内容示例：
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
Checking for and handling UPKUAJING_API_KEY in ~/.upkuajing/.env as part of the skill workflow creates direct interaction with locally stored credentials. Because the same flow can lead to automatic issuance and storage of secrets, it raises the risk of exposing, overwriting, or persisting credentials without a clearly separated trust boundary.
- Content
md ### **未设置API密钥** 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择；
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
Automatically saving a newly obtained API key into ~/.upkuajing/.env is a sensitive credential write operation. This is dangerous because it lets a skill whose stated purpose is merely domain checking create and persist authentication material on the local system, potentially without sufficient transparency, access control, or auditability.
- Content
md 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file implements authentication, account lookup, pricing, and recharge/payment functions, which materially exceed the declared purpose of a domain-validity and risk-checking skill. This capability mismatch is dangerous because users or orchestrators may grant the skill trust and permissions appropriate for domain screening, while the code performs account-management and billing actions instead.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code can create API keys, inspect balances, and generate recharge orders, all of which are sensitive account-management actions not required for domain verification. In the context of this skill, these hidden or unexpected capabilities increase the risk of unauthorized account changes, financial abuse, or misleading users about what the skill actually does.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
This line is part of writing a plaintext API key into a .env file, which constitutes insecure credential storage rather than credential access. In the context of a domain-checking skill, silently persisting newly issued secrets locally broadens exposure if the file is later read by other tools, committed accidentally, or stored with weak permissions.
- Content
python "envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script’s implemented behavior is remote exception reporting, which does not match the declared skill purpose of domain validity and risk checking. This functionality mismatch is security-relevant because it can conceal undisclosed data flows and expands the skill’s capabilities beyond user expectations, increasing the chance that operational or user-supplied context is transmitted off-box without informed consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This module adds update-checking and upgrade notification behavior that is unrelated to the stated domain-validation purpose of the skill. Even though the code is not overtly malicious, it introduces extra network activity, telemetry about installed skills, and side effects to stderr and local state that users may not expect from a domain-checking skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares capabilities that imply environment access, file read/write, and network use, but it does not scope or constrain those powers through explicit permissions. In a skill that can read local configuration and contact external services, missing tool scope increases the chance of overbroad access, unintended credential exposure, or actions outside the user-visible purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description and all operational instructions are written exclusively in Chinese, including prescribed user-facing prompts such as asking the user to choose how to provide an API key and guiding payment flow. There is no indication that the skill can adapt to the user's preferred language or that the Chinese-only constraint is justified as a region-specific requirement.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Allowing the skill to request a new API key and automatically write it into a local environment file exceeds the minimum capability needed for domain checking. This introduces credential lifecycle management into a validation skill, increasing the risk of secret mishandling, unauthorized persistence, or confusing users into granting broader trust than intended.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Creating recharge orders and presenting payment URLs is not directly necessary for checking domain validity. Embedding payment workflow inside a utility skill broadens the trust boundary and can be abused for unexpected billing-related actions or phishing-like user confusion if the destination is not tightly controlled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document instructs agents to send request parameters, response payloads, and error context to a central error-reporting API, which can include sensitive operational or user data. Although it notes that some sensitive fields are 'automatically desensitized,' it does not define the scope of redaction, require data minimization, or warn operators about privacy and data-sharing implications, creating a real risk of oversharing secrets, personal data, or confidential business content during failure reporting.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring identifies the component as authentication management, directly conflicting with the advertised purpose of domain safety/availability verification. This inconsistency is a meaningful trust and transparency problem because it suggests the skill may be repurposed or bundled with unrelated sensitive functionality.
- Content