Checks domain availability to confirm valid or inactive status for corporate websitedomains. It helps sales teams, marketers and researchers validate company domains andimprove email deliverability. As an essential tool for CRM data cleansing, sales-leadverification, supplier validation and email-list scrubbing, it supports pre-deliverycleanup before bulk foreign-trade email campaigns, recruitment background checks and buyerverification.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:00 AM UTC
• Version: 1.0.2

Overview

The skill mainly checks domain validity, but it also includes broader account, billing, credential storage, telemetry, and automatic version-check behavior that users should review before installing.

Install only if you are comfortable sending checked domains to upkuajing.com, storing an API key in ~/.upkuajing/.env, and using this skill for paid API workflows. Before using top-up, account, or error-report features, confirm the action and avoid reporting raw customer data, secrets, tokens, or full CRM payloads.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior requires access to environment variables, local files under the user's home directory, and remote network services. This mismatch weakens transparency and consent, making it easier for a user or runner to invoke capabilities with broader access than the skill description suggests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is domain validation, but the skill also handles account management, pricing, payment/top-up flows, error reporting to the platform, and remote version-related activity. That behavior expansion increases attack surface and creates opportunities for unexpected data disclosure, social engineering through payment URLs, and execution of actions outside the user's expected intent.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements API key provisioning, account lookup, pricing, and recharge-order creation, which are unrelated to the stated purpose of domain validity checking. In an agent-skill context, this scope mismatch is dangerous because it gives the skill capabilities to create credentials and perform billing/account actions that a user invoking domain verification would not reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Creating recharge/payment orders is a sensitive financial operation and is unjustified for a domain-validity-check skill. If exposed through an agent workflow, it could trigger unintended charges, phishing-like payment redirection, or unauthorized financial actions under misleading skill branding.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Account-information and pricing retrieval are out of scope for domain validation and expose extra business/account data through a misleadingly named skill. Even if not directly destructive, this broadens the data surface and can leak account identifiers, balances, and commercial details to callers that only intended list-cleaning operations.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The imported version-check routine causes an additional network interaction outside the core domain-validation flow, which expands the trust boundary and can disclose execution metadata such as usage timing, host IP, or environment context to a third party. In a skill meant for validating corporate domains, unsolicited ancillary callbacks are harder to justify and increase supply-chain and privacy risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The request/response logging helpers can persist arbitrary API payloads and responses to local disk, which may include customer domains, CRM data, API outputs, and possibly sensitive metadata. Even though logging is disabled by default, the capability creates a latent data exposure risk if enabled without redaction, retention limits, or access controls.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements outbound exception telemetry to a platform endpoint and sends request metadata plus free-form context, which is outside the stated domain-validation purpose of the skill. In a domain-validation skill context, hidden remote reporting increases the risk of unexpected data exfiltration, especially if requestPath, requestId, or context contain customer, workflow, or operational details.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code gives the skill a platform exception-reporting capability that is not justified by its advertised role of corporate domain verification. Unnecessary network/reporting capabilities broaden the attack surface and can be abused to leak operational or user-supplied data during failures.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module makes outbound network requests to a remote API and stores persistent state in the user's home directory, behavior that is unrelated to the stated purpose of corporate domain validation. In a skill context, hidden or undocumented secondary capabilities expand the trust boundary, create privacy and integrity risks, and could be abused to beacon usage or influence users via upgrade prompts.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code implements self-update/version-check functionality that does not support domain verification, making it an unnecessary hidden feature in this skill. Even without direct code execution, such logic can enable covert telemetry, unexpected network dependencies, and social engineering through upgrade notices, which is risky when users expect only domain-validation behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The API documentation explicitly encourages sending `requestParams`, `responseData`, and detailed `context` containing stack traces or error information to a remote reporting endpoint. Although it claims sensitive fields are automatically desensitized, there is no clear guidance to minimize data collection, avoid including secrets, or verify that masking is comprehensive, which creates a realistic risk of leaking PII, credentials, tokens, or business-sensitive payloads during error reporting.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code can write transmitted API inputs and outputs to local log files without any user-facing disclosure or consent mechanism. In the context of email-list scrubbing and CRM cleansing, those payloads may contain business contact data, making silent persistence a meaningful privacy and compliance concern.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function transmits request metadata and a caller-provided context field to a remote endpoint without any disclosure or consent mechanism visible in this file. Because context is free-form, it may contain sensitive business data, error traces, or user content, creating a privacy and data-handling risk if sent automatically on exceptions.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

• Confidence: 88% confidence
• Finding: The skill instructs checking and modifying a credential file in the user's home directory to obtain the API key. Even if intended for normal configuration, accessing and directing writes to sensitive credential storage creates credential-handling risk, especially if the skill or surrounding tooling can read, expose, or overwrite secrets.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: Writing a newly issued API key to a plaintext .env file on disk creates a local secret-exposure risk, especially if file permissions are not tightened or the directory is synced, backed up, or shared. In this skill context, the danger is amplified because secret provisioning is hidden inside a tool that claims to do domain validation, so users may not expect credential material to be created and persisted.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including future major releases with breaking changes or versions that may later introduce security regressions. This weakens build reproducibility and supply-chain control, making it harder to ensure the skill is deployed with a known-safe dependency set.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: The explicit require_auth=False setting is an unsafe default for a credential-provisioning endpoint because it normalizes unauthenticated access to sensitive account bootstrap operations. In this context, it increases the chance that a seemingly harmless domain-checking skill can be repurposed to mint credentials without adequate trust checks.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: The explicit require_auth=False setting is an unsafe default for a credential-provisioning endpoint because it normalizes unauthenticated access to sensitive account bootstrap operations. In this context, it increases the chance that a seemingly harmless domain-checking skill can be repurposed to mint credentials without adequate trust checks.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196