邮箱有效性检查，验证邮箱地址格式，有效和无效状态。帮助销售团队、招聘人员、市场营销人员验证邮箱有效性、降低邮件退信率、提升外联与冷启动效率——是 CRM数据清洗、候选人筛查、供应商核验、邮件列表清洗的必备工具，适用于外贸邮件群发前清洗、招聘背调与采购商核实。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 1.0.2

Overview

The skill appears to perform email validation through a paid external API, but its credential handling and undisclosed side effects need review before installation.

Review this skill before installing. Do not let an agent print or paste the contents of ~/.upkuajing/.env; configure the API key through a safer secret mechanism if possible. Treat submitted email addresses as shared with Upkuajing's remote service, confirm paid operations before running validation, and be cautious with recharge/order and error-reporting commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45

Finding

API Key May Be Exposed Through Direct File Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-58
Vulnerability Type: Credential disclosure through Agent-visible output
Risk Level: High

Vulnerable Code

bash

cat ~/.upkuajing/.env

The surrounding instructions direct the Agent to inspect this file when verifying whether UPKUAJING_API_KEY is configured.

Technical Analysis

The .env file contains the complete bearer API key. Printing the file is not necessary because the implementation in scripts/common.py can retrieve the credential directly from the process environment or the dedicated configuration file.

Executing the documented command places the plaintext credential in command output. Depending on the Agent runtime, that output may subsequently be included in model context, chat transcripts, execution logs, telemetry, debugging records, or other storage with a broader audience than the original credential file.

This behavior exceeds minimum privilege. The Skill only needs to determine whether the expected key exists and use it as an authorization header; it does not need to reveal the key to the Agent or user.

Attack Path

1. A user invokes the Skill without an API key available in the process environment.
2. The Agent follows the Skill documentation and executes the documented cat command.
3. The entire .env file, including UPKUAJING_API_KEY, is returned through tool output.
4. The plaintext key enters the Agent context or associated logs and transcripts.
5. A party with access to those records obtains the bearer token.
6. The exposed token is reused against the provider API for authenticated operations, including potentially chargeable requests and account-information retrieval.

Impact Assessment

Successful exploitation discloses a reusable bearer credential. The attacker obtains the same provider API privileges assigned to the key, potentially including paid email-validation requests, account-inf ...[truncated 278 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all instructions that print the .env file or its contents.
• Check only whether the variable exists and is non-empty, without returning its value.
• Prefer injecting UPKUAJING_API_KEY through the Agent platform's secret-management mechanism.
• If status must be displayed, return only a boolean result or a heavily masked identifier.
• Never ask users to paste the complete API key into a conversation.
• Ensure command output, exception messages, request logs, and telemetry redact authorization values.
• Update the instructions to state that credential configuration must occur outside the conversational context.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:60

Finding

Plaintext API Key File Is Created Without Enforced Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 60-73
Vulnerability Type: Insecure local credential storage
Risk Level: Medium

Vulnerable Code

python

try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")
except IOError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but saving the environment file failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

Technical Analysis

The code stores a reusable bearer credential in plaintext at ~/.upkuajing/.env, but neither the directory nor the file is assigned an explicit owner-only permission mode. Their effective permissions therefore depend on the process umask and any pre-existing filesystem object.

On a shared host or a system with a permissive umask, the file may be readable by other local users or processes. If the file already exists with insecure permissions, opening it with write mode does not correct those permissions.

The code also overwrites the complete .env file rather than updating only the relevant variable. That can remove unrelated settings, although the primary security concern is credential confidentiality.

Attack Path

1. A user or Agent runs auth.py --new_key.
2. The unauthenticated key-creation endpoint returns a new API key.
3. The script creates or overwrites ~/.upkuajing/.env using permissions inherited from the current umask or existing file.
4. On a permissively configured shared system, another local user or process reads the file.
5. The attacker extracts UPKUAJING_API_KEY.
6. The attacker reuses the key for aut ...[truncated 707 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700.
• Create the credential file atomically with mode 0600, and explicitly correct permissions on an existing file before writing.
• Use a temporary file in the same protected directory, flush and synchronize it, set its permissions, and atomically replace the destination.
• Refuse to use the file if it is owned by another user, is a symbolic link, or has unsafe permissions.
• Preserve unrelated configuration entries instead of overwriting the complete file.
• Prefer an operating-system credential store or the Agent platform's secret-management facility over a plaintext .env file.
• Avoid displaying any portion of the existing key, including the current ten-character prefix.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Runtime Dependency Is Not Reproducibly Pinned

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unbounded third-party dependency resolution
Risk Level: Low

Vulnerable Code

text

httpx>=0.23.0

The Skill documentation directs installation with:

bash

pip install -r requirements.txt

Technical Analysis

The lower-bound-only dependency declaration permits package installers to select any later compatible release available at installation time. There is no exact version lock, upper bound, artifact hash, or documented trusted package index.

No evidence was found that the current httpx package is malicious. The risk is that future installations may resolve to code that was not part of this audit. This weakens reproducibility and expands the supply-chain trust boundary beyond the reviewed project.

Attack Path

1. The Agent follows the setup instructions and invokes pip install -r requirements.txt.
2. The package resolver queries the configured package index and selects a release satisfying the lower-bound constraint.
3. A future compromised, malicious, or incompatible release may therefore be installed without a project change.
4. The selected dependency executes in the Python process when the Skill imports and uses httpx.
5. A compromised dependency would inherit the Skill process's access to user-supplied email addresses, the API key, local files accessible to that process, and outbound networking.

This is a conditional supply-chain path rather than evidence of a presently malicious dependency.

Impact Assessment

A compromised dependency would run with the operating-system privileges of the Skill process. It could potentially access the bearer API key, email addresses being validated, and files available to that user account, or make unauthorized outbound requests.

The practical likelihood is lower than the credential-handling findings because exploitation depends on compr ...[truncated 58 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx and its transitive dependencies to reviewed versions in a generated lock file.
• Include cryptographic hashes and install with hash verification enabled.
• Use a trusted, explicitly configured package index or an internally controlled artifact repository.
• Perform automated vulnerability and integrity scanning when updating the lock file.
• Review dependency changes before release and establish a regular update process so exact pinning does not prevent timely security patches.
• Install dependencies in an isolated virtual environment with only the permissions required by the Skill.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a severe purpose/behavior mismatch: the skill may perform version checks, local caching, file I/O, and upgrade messaging without actually carrying out the promised validation workflow. A skill that does not reliably do its stated job but still exercises network and local-system capabilities is especially risky because users cannot accurately infer what data or actions are involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This finding indicates a severe purpose/behavior mismatch: the skill may perform version checks, local caching, file I/O, and upgrade messaging without actually carrying out the promised validation workflow. A skill that does not reliably do its stated job but still exercises network and local-system capabilities is especially risky because users cannot accurately infer what data or actions are involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a severe purpose/behavior mismatch: the skill may perform version checks, local caching, file I/O, and upgrade messaging without actually carrying out the promised validation workflow. A skill that does not reliably do its stated job but still exercises network and local-system capabilities is especially risky because users cannot accurately infer what data or actions are involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates a severe purpose/behavior mismatch: the skill may perform version checks, local caching, file I/O, and upgrade messaging without actually carrying out the promised validation workflow. A skill that does not reliably do its stated job but still exercises network and local-system capabilities is especially risky because users cannot accurately infer what data or actions are involved.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documentation instructs reading the entire ~/.upkuajing/.env file with cat, which can expose API keys and potentially other secrets stored alongside them. In an agent skill context, encouraging broad credential-file access is especially dangerous because it normalizes retrieval of secrets from a sensitive home-directory location.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill directs the agent to inspect ~/.upkuajing/.env for UPKUAJING_API_KEY and, if absent, obtain a new key and automatically save it to the same file. This combines credential discovery, credential creation, and persistent local storage in a way that expands secret handling risk and may overwrite or expose sensitive configuration without strong controls.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documented flow persists newly obtained API keys into a local .env file in the user's home directory, creating a long-lived secret on disk that may be accessible to other tools, sessions, or users depending on file permissions. In the context of a network-enabled skill, persistent credential storage materially increases the blast radius of compromise.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements account and billing capabilities—API key issuance, account info retrieval, recharge order creation, and pricing lookup—that are unrelated to the declared email-validation purpose of the skill. This expands the skill’s privilege and attack surface, enabling credential provisioning and payment-related actions that a user may not expect from an email hygiene tool.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 74% confidence

Finding

The script reads the entire .env file and later includes part of the existing API key in a user-visible message, increasing the chance of inadvertent secret disclosure through logs, terminal history, screenshots, or support output. Even partial credential exposure can aid token identification and operational leakage.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code writes the newly issued API key directly to a plaintext .env file under the user directory without any visible permission hardening or secure storage mechanism. In a multi-user or weakly configured environment, this can expose reusable credentials to other local processes or users.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file’s purpose is platform error reporting, which does not align with the declared skill function of validating email addresses. This mismatch is dangerous because it introduces undeclared behavior and an additional data flow to the platform, increasing the chance that operational or user-supplied context is transmitted unexpectedly under the guise of an unrelated skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This module performs outbound network communication to a remote version endpoint and persists state in the user's home directory, behavior that is unrelated to the declared purpose of email validity checking. Even if the transmitted data is limited to the skill name, this creates an unexpected telemetry/update channel and filesystem side effect that can violate least-privilege expectations and user consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises executable behaviors involving environment access, local file reads/writes, and network use, but does not declare any explicit tool scope or permission boundaries. In a skill that can read credentials from a home-directory .env file and contact remote APIs, missing scope declarations reduce auditability and increase the chance of overbroad execution or unintended data access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instructions are written as mandatory agent behaviors in Chinese, such as prompting the user, guiding payment, and explaining exceptions, but they do not offer any language or locale choice. This creates a natural-language policy concern because the skill appears to require Chinese-language interaction by default rather than obtaining user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document instructs agents to send request parameters, response data, and exception context to an external error-reporting API, which can easily include user emails, API responses, stack traces, and other sensitive operational data. Although it mentions automatic masking of sensitive fields, it does not define what is masked, require minimization, or warn operators not to include personal or confidential data, creating a realistic risk of unintended data exfiltration or over-collection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s docstrings, CLI description, help text, and user-facing messages are all exclusively in Chinese, with no indication that the user can select another language or that the skill is intentionally restricted to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends user-supplied email addresses to an external API endpoint via make_request('/agent/validation/email', params) without any explicit user-facing disclosure, confirmation, or privacy notice at runtime. Because email addresses are personal/contact data and the skill is explicitly marketed for list cleaning, this creates a real data-sharing and compliance risk if operators do not realize the addresses leave their environment.

Content

No source excerpt is available for this finding.