Checks domain availability to confirm valid or inactive status for corporate websitedomains. It helps sales teams, marketers and researchers validate company domains andimprove email deliverability. As an essential tool for CRM data cleansing, sales-leadverification, supplier validation and email-list scrubbing, it supports pre-deliverycleanup before bulk foreign-trade email campaigns, recruitment background checks and buyerverification.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:06 AM UTC
• Version: 1.0.2

Overview

The skill mostly does the advertised domain-checking work, but it also persists a paid-service API key and performs an undisclosed remote version check.

Review before installing. Use this skill only if you are comfortable sending domains to UpKuajing's API, paying per API call, and storing the service API key locally. After setup, restrict ~/.upkuajing and ~/.upkuajing/.env to owner-only permissions, avoid sharing raw customer data in error reports, and do not run top-up or key-creation commands unless you explicitly intend to.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API Key Stored Without Enforced Owner-Only File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py:62-73
Vulnerability Type: Insecure plaintext credential storage permissions
Risk Level: Medium

Vulnerable Code

python

# Ensure ~/.upkuajing directory exists
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

# Save to .env file
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The Skill stores the API key in plaintext at ~/.upkuajing/.env but does not explicitly enforce owner-only permissions on either the directory or the credential file. The effective permissions therefore depend on the user's current umask and any permissions already assigned to an existing file.

If the file already exists with permissive permissions, opening it with mode w truncates and rewrites it without correcting those permissions. On a multi-user system, another local account or process may consequently be able to read the Bearer credential.

Reading this specific credential is necessary for authenticated domain-validation requests and does not, by itself, exceed the minimum privilege required by the declared functionality. The vulnerability concerns how that necessary credential is stored.

Attack Path

1. A user invokes the API-key creation function.
2. The Skill creates or overwrites ~/.upkuajing/.env.
3. A permissive umask or pre-existing permissive file mode leaves the credential readable by unintended local users or processes.
4. A local attacker reads UPKUAJING_API_KEY from the file.
5. The attacker submits authenticated requests to the provider using the stolen Bearer credential.

This path requires local filesystem access under permissions that allow the attacker to read the file.

Impact Assessment

A ...[truncated 460 chars]

Remediation

View remediation

Remediation Suggestions

1. Create ~/.upkuajing with owner-only permissions, such as mode 0700.
2. Create the credential file atomically with mode 0600, rather than relying on the process umask.
3. If the file already exists, verify and correct its permissions before writing.
4. Reject symbolic links and other unexpected file types before overwriting the credential path.
5. Use an atomic temporary-file-and-rename procedure to avoid partial writes.
6. Prefer an operating-system credential manager or secret store where available.
7. Avoid displaying any portion of an existing key in status messages.
8. Document the required ownership and permissions and warn the user if they cannot be enforced.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Allows Non-Reproducible Package Resolution

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned dependency and missing package integrity verification
Risk Level: Low

Vulnerable Code

text

httpx>=0.23.0

The installation instruction in SKILL.md:21 directs users to resolve this dependency directly:

bash

pip install -r requirements.txt

Technical Analysis

The lower-bound-only version constraint permits the package resolver to install any current or future release of httpx that is version 0.23.0 or newer. No lock file or cryptographic hashes are supplied, so installations are not reproducible and package integrity is not constrained to an audited artifact set.

This is a supply-chain hardening weakness rather than evidence that the currently named httpx package is malicious. Exploitation would require compromise of a permitted package release, a transitive dependency, the configured package index, or the user's package-resolution environment.

Attack Path

1. An attacker compromises an allowed future release, a transitive dependency, or a package source used by the victim.
2. The user follows the documented command to install the requirements.
3. The resolver selects the compromised artifact because the requirement allows an unrestricted newer version and does not verify an expected hash.
4. Malicious package installation hooks or imported code execute in the context of the user running the installation or Skill.
5. The malicious code obtains the permissions and data available to that user process.

No malicious package was identified in the audited project; this path describes the risk introduced by unconstrained dependency resolution.

Impact Assessment

If the dependency supply chain were compromised, attacker-controlled code could execute with the privileges of the user performing installation or running the Skill. Depending on that user's environment, the code could read accessible files and environment variables, ...[truncated 275 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin httpx and all transitive dependencies to reviewed, exact versions.
2. Generate a reproducible lock file using a dependency-management tool.
3. Record cryptographic hashes for every permitted distribution and install with hash verification, such as pip's --require-hashes mode.
4. Review and update pinned dependencies through a controlled vulnerability-management process.
5. Install dependencies in an isolated virtual environment rather than the system Python environment.
6. Use a trusted package index and disallow unapproved extra indexes.
7. Avoid running package installation as an administrator or root user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs remote version checks and writes a cache file in the user's home directory, which is unrelated to domain validation as described. Undisclosed update-check and local caching behavior creates extra network and filesystem exposure and may leak usage patterns or persist data unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill performs remote version checks and writes a cache file in the user's home directory, which is unrelated to domain validation as described. Undisclosed update-check and local caching behavior creates extra network and filesystem exposure and may leak usage patterns or persist data unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs remote version checks and writes a cache file in the user's home directory, which is unrelated to domain validation as described. Undisclosed update-check and local caching behavior creates extra network and filesystem exposure and may leak usage patterns or persist data unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill performs remote version checks and writes a cache file in the user's home directory, which is unrelated to domain validation as described. Undisclosed update-check and local caching behavior creates extra network and filesystem exposure and may leak usage patterns or persist data unexpectedly.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly directs checking and populating a local ~/.upkuajing/.env file for an API key, which involves handling credentials from disk and prompting the user to provide secrets. In an agent setting, credential access is highly sensitive because it can enable unauthorized API use, leakage through logs or prompts, or reuse by unrelated skill behaviors.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements API key issuance, account lookup, recharge order creation, and pricing retrieval, which are unrelated to the advertised domain-validity-check purpose. This scope mismatch is dangerous because it introduces hidden account-management and monetization capabilities into a data-validation skill, increasing the chance of unauthorized credential handling or unexpected financial actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 71% confidence

Finding

The script reads an existing .env file and parses the API key, which is sensitive credential material. While local secret reads can be legitimate, in the context of a mislabeled domain-validation skill this behavior increases risk because the skill handles secrets unrelated to its stated purpose and could expose them through future changes, logs, or misuse.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Writing an API key into a plaintext .env file constitutes insecure credential storage. If the host is shared, backed up, synced, or the file is accidentally committed, the secret can be recovered and used to access the linked service account.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Creating recharge orders is unjustified for a domain verification skill and can enable unexpected payment-related actions from a context where users would not anticipate billing behavior. Even if it only returns a payment URL, it expands the attack surface into financial workflows and could be abused for social engineering or unauthorized spending initiation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says this skill verifies corporate domain validity for email-list scrubbing and CRM cleansing, but this file implements exception reporting to a platform endpoint. Reporting Agent/Skill errors is not an obvious implementation detail of domain-status verification itself, so the code behavior materially diverges from the declared skill purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises executable scripts that use environment variables, local file access, and outbound network calls, but it does not declare any explicit tool permissions or scope boundaries. This increases the chance of overbroad execution in an agent environment, where the skill may access credentials or the filesystem without transparent least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and loosely scoped, which can cause the skill to activate in contexts beyond simple domain validation. In an agent ecosystem, ambiguous invocation language increases the risk that a skill with network, file, and credential access is selected for tasks the user did not intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document explicitly encourages reporting raw request parameters, response data, and exception context to a remote error-reporting API. Although it claims sensitive fields are automatically redacted, it does not define what is considered sensitive, does not require caller-side minimization, and allows stack traces/error context up to 2000 characters, which commonly contain tokens, PII, internal URLs, and business data. In the context of a CRM/email-list/domain-validation skill, request and response payloads may include customer contact data and operational metadata, making accidental data leakage more likely.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 81% confidence

Finding

The explicit use of require_auth=False for the key-creation endpoint signals that credential issuance is available without prior authentication. That may be acceptable for a signup flow, but it is still a risky default and should not be embedded unexpectedly in a non-authentication skill because it broadens abuse potential.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 81% confidence

Finding

The explicit use of require_auth=False for the key-creation endpoint signals that credential issuance is available without prior authentication. That may be acceptable for a signup flow, but it is still a risky default and should not be embedded unexpectedly in a non-authentication skill because it broadens abuse potential.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script writes a newly issued API key directly into a local .env file, creating persistent credentials without an explicit pre-action warning or secure storage controls. Persisting secrets this way increases the risk of accidental disclosure through backups, repo inclusion, permissive file permissions, or other local compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Account-info and pricing retrieval expose administrative capabilities that do not align with domain validation and may reveal sensitive operational or financial metadata. In a mislabeled skill, such features can surprise users and facilitate reconnaissance against the linked service account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language documentation and console messages exclusively in Chinese, beginning with the module docstring. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a skill for verifying corporate domain validity to clean CRM or email lists. In addition to API access, this file implements broad local file-writing and task-management facilities, including saving arbitrary data, task metadata, and result sets under a task_data directory, which is a materially wider behavior than simple domain-status checking.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196