邮箱有效性检查，验证邮箱地址格式，有效和无效状态。帮助销售团队、招聘人员、市场营销人员验证邮箱有效性、降低邮件退信率、提升外联与冷启动效率——是 CRM数据清洗、候选人筛查、供应商核验、邮件列表清洗的必备工具，适用于外贸邮件群发前清洗、招聘背调与采购商核实。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:39 AM UTC
• Version: 1.0.2

Overview

This skill validates emails through a paid external API, but it also includes credential creation, local secret storage, recharge/account flows, and automatic version checks that users should review carefully.

Install only if you are comfortable sending email addresses to Upkuajing's external API and letting the skill manage a paid API account. Review the credential and recharge flows before use, prefer manually provisioning the API key, and be aware it may write ~/.upkuajing/.env and ~/.upkuajing/version_cache.json.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions, yet the documentation clearly indicates capabilities to access environment variables, read and write local files under ~/.upkuajing, and call remote network APIs. This creates a transparency and consent gap: operators may authorize a seemingly simple email-validation skill without realizing it can manipulate local credentials and interact with billing-related endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is only email validity checking, but the skill also documents functionality for API key enrollment, credential persistence, account/balance access, recharge order creation, price lookup, error reporting, and version caching. This mismatch is dangerous because users may provide trust and approval for a narrow validation task while the skill can drive account changes, write secrets locally, and initiate chargeable or externally reporting actions beyond that scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to apply for a new API key and automatically save it to ~/.upkuajing/.env when one is missing. That exceeds the minimum capability needed to validate email addresses and introduces credential creation and local secret-writing behavior that can persist beyond the current task.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documentation includes creating recharge orders and directing the user to a payment URL, which is not directly required for email validity checking. Embedding billing flows in an operational validation skill increases the risk of unexpected financial actions and expands the attack surface for abuse or social engineering.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements account-management capabilities such as API key issuance, account info lookup, recharge order creation, and pricing queries, which are materially outside the stated email-validation purpose of the skill. This scope mismatch is dangerous because it introduces billing and credential-management behaviors users would not reasonably expect from an email-cleaning tool, increasing the risk of undisclosed account actions and abuse.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code can create new API keys and generate recharge/payment orders, giving it account-operational power unrelated to validating email addresses. In the context of a narrowly described email verification skill, these capabilities create a hidden avenue for credential provisioning and financial actions that could be triggered without informed user understanding.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The module docstring openly states it handles authentication management, API key application, and recharging, directly conflicting with the public description of an email validity checker. Such discrepancies are a supply-chain trust risk because they indicate hidden or misleading functionality that can mask sensitive operations.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This module adds out-of-scope behavior for an email-validation skill by making external network requests and persisting local cache data under the user's home directory. Even though it only appears to send the skill name, undisclosed telemetry and filesystem writes expand the attack surface, create privacy concerns, and violate least-privilege expectations for the advertised functionality.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code implements a self-update/version telemetry path unrelated to validating email addresses, which is a strong security and trust concern in a skill whose declared purpose is narrow and data-processing focused. Hidden auxiliary capabilities can be repurposed for tracking, command-and-control-style checks, or future unauthorized behavior, especially because the destination is supplied via api_base_url.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation describes sending email addresses and a bearer token to an external API but provides no warning about sensitive data transmission, third-party processing, or handling requirements for credentials. In the context of an email validation skill, this omission can cause users or downstream agents to disclose personal data and secrets without informed consent, creating privacy, compliance, and credential-exposure risk.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The script makes remote API requests for key creation and account operations without any user-facing disclosure in this file about what data is sent, what external service is contacted, or what side effects occur. For a skill presented as email validation, silent networked account operations increase privacy and transparency risks and can lead to unexpected credential or billing changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends user-provided email addresses to an external API endpoint via make_request('/agent/validation/email', params) without any explicit user-facing disclosure, consent prompt, or data-handling notice at the point of transmission. Because email addresses are personal data in many contexts, silent transfer to a remote service creates privacy, compliance, and trust risks, especially when users may assume validation is performed locally.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script uploads a caller-supplied context field and request metadata to a remote endpoint without any visible sanitization, redaction, consent flow, or disclosure. If upstream callers include sensitive data such as email addresses, message content, tokens, or customer details in context, this can cause unintended exfiltration of user or operational data to platform telemetry.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The HTTP request transmits the skill name to a remote endpoint without any disclosure in this file or visible user-facing consent flow. While the data item is limited, undisclosed outbound communication is still a privacy and transparency issue and becomes more concerning because it is unrelated to the skill's stated email-validation purpose.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill explicitly instructs checking ~/.upkuajing/.env for UPKUAJING_API_KEY and supports writing a newly obtained key there. Accessing and modifying local credential files is sensitive because it exposes secrets to the skill path and creates persistent authentication material on the host, which can be abused if the skill or environment is compromised.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: The follow-on instruction to request a new API key and automatically save it into ~/.upkuajing/.env reinforces persistent credential handling inside a skill whose advertised purpose is mailbox validation. This is dangerous because it normalizes secret generation and storage in a workflow that users may not expect to have credential-management powers.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: The script writes a newly issued API key into a .env file in the user's home configuration directory, creating or modifying local credentials as a side effect. In the context of an email verification skill, silently provisioning and persisting secrets is dangerous because it expands compromise impact if local files are exposed and performs sensitive state changes users may not expect.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including major releases with breaking changes or future vulnerable versions. This weakens build reproducibility and supply-chain control, making it easier for environments to drift into insecure or untested dependency states.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: Using require_auth=False for key issuance reflects an unsafe default for a sensitive operation. Even if intended as a convenience bootstrap flow, permitting credential creation without prior authentication materially increases abuse potential and is made more suspicious by the mismatch between the skill's declared purpose and its actual account-management behavior.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: Using require_auth=False for key issuance reflects an unsafe default for a sensitive operation. Even if intended as a convenience bootstrap flow, permitting credential creation without prior authentication materially increases abuse potential and is made more suspicious by the mismatch between the skill's declared purpose and its actual account-management behavior.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196