Validates email addresses by checking format compliance and active-or-inactive status. Ithelps sales teams, recruiters and marketers confirm email authenticity, lower bounce ratesand boost cold-outreach performance. This indispensable tool delivers CRM data cleansing,candidate screening, supplier verification and email-list scrubbing. It works for pre-sendcleanup before bulk foreign-trade email campaigns, recruitment background checks and buyervalidation.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches an email-validation API client, but it bundles credential persistence, billing/account actions, and undisclosed update-check behavior that users should review before installing.

Install only if you trust UpKuajing with the email addresses you submit and with the associated paid API account. Review the ~/.upkuajing/.env credential file permissions, avoid sending sensitive request/response bodies in error reports, and require an explicit user confirmation before any top-up or payment-order command is run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:60

Finding

API Key Stored Without Enforced Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py:60-73
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

python

# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The Skill legitimately requires an API key to authenticate requests, so reading a dedicated key from UPKUAJING_API_KEY or ~/.upkuajing/.env does not exceed the minimum functional privilege by itself. However, the key-creation workflow stores the bearer token in a plaintext file without explicitly setting owner-only permissions.

Path.mkdir() and open(..., 'w') rely on the process umask to determine permissions. Under a permissive or misconfigured umask, the directory or file may be readable by other local accounts. The code also does not verify that the destination is owned by the current user or reject a pre-existing symbolic link. Opening the file in write mode truncates its previous contents.

Attack Path

1. A victim runs python scripts/auth.py --new_key.
2. The service returns a new API key.
3. The script writes the key to ~/.upkuajing/.env using permissions derived from the current umask.
4. On a multi-user system with permissive resulting permissions, another local user reads the file and obtains the bearer token.
5. The attacker uses the token against the Upkuajing API to access associated account functions or consume paid services within the privileges assigned to that token.

If an attacker can pre-create or manipulate the destination as a symbolic link, the unchecked write may also overwrite a fil ...[truncated 646 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700 and verify that it is owned by the current user.
• Create the credential file atomically with mode 0600, rather than relying on the ambient umask.
• Reject symbolic links and unexpected file types before reading or replacing the credential file.
• Write to a securely created temporary file in the same directory, flush it, set its permissions, and atomically replace the destination.
• Preserve unrelated .env entries instead of truncating the entire file.
• Prefer the process environment or an operating-system credential store where available.
• Avoid displaying any portion of the existing key in output, including the prefix currently shown by scripts/auth.py:33.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned supply-chain dependency
Risk Level: Low

text

httpx>=0.23.0

The documented installation instruction in SKILL.md:20-21 is:

text

1. **Check Python**: `python --version`
2. **Install dependencies**: `pip install -r requirements.txt`

Technical Analysis

The requirement specifies only a minimum version. It therefore permits any compatible future httpx release selected by the package resolver, along with changing transitive dependency versions. No lock file, package hashes, upper version constraint, or reviewed dependency snapshot is supplied.

This does not prove that the current httpx package is malicious. The risk is that installation is not reproducible and automatically trusts future packages and transitive dependency releases that were not part of this audit. A compromised upstream release or dependency could execute code during installation or when imported by the Skill.

Attack Path

1. A user follows the documented setup process and runs pip install -r requirements.txt.
2. The package resolver selects the newest release satisfying httpx>=0.23.0, plus its current transitive dependencies.
3. A future compromised, malicious, or unexpectedly incompatible release satisfies that range.
4. The affected package is installed into the user's Python environment.
5. Malicious package logic executes during installation or when the Skill imports httpx.

This exploitation path depends on a future upstream or package-index compromise; no malicious dependency was identified in the audited files.

Impact Assessment

A malicious dependency would execute with the same operating-system privileges as the user running installation or invoking the Skill. Depending on those privileges, it could read accessible files and environment variables, including UPKUAJING_API_KEY, alter user files, o ...[truncated 214 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a specifically reviewed version rather than using an open-ended lower bound.
• Generate and commit a lock file containing exact transitive dependency versions.
• Record and enforce package hashes, for example by installing with pip --require-hashes.
• Perform automated vulnerability and license scanning on the locked dependency set.
• Review and deliberately test dependency upgrades before updating the lock file.
• Install dependencies in an isolated virtual environment under a non-privileged account.
• Configure installation to use an explicitly trusted package index.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version-checking, metadata reads from SKILL.md, cache writes under ~/.upkuajing, and update notifications are ancillary behaviors unrelated to validating email addresses. These extra network and filesystem operations widen attack surface and create user-surprising side effects for a tool that appears simple and narrowly purpose-built.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Version-checking, metadata reads from SKILL.md, cache writes under ~/.upkuajing, and update notifications are ancillary behaviors unrelated to validating email addresses. These extra network and filesystem operations widen attack surface and create user-surprising side effects for a tool that appears simple and narrowly purpose-built.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version-checking, metadata reads from SKILL.md, cache writes under ~/.upkuajing, and update notifications are ancillary behaviors unrelated to validating email addresses. These extra network and filesystem operations widen attack surface and create user-surprising side effects for a tool that appears simple and narrowly purpose-built.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version-checking, metadata reads from SKILL.md, cache writes under ~/.upkuajing, and update notifications are ancillary behaviors unrelated to validating email addresses. These extra network and filesystem operations widen attack surface and create user-surprising side effects for a tool that appears simple and narrowly purpose-built.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill explicitly directs checking and using a credential stored in ~/.upkuajing/.env, indicating access to local secret material. In the context of a third-party skill, local credential file access is sensitive because it can expose, misuse, or normalize handling of API secrets in ways users may not fully appreciate.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: Guide user to apply at [Open Platform](https://developer.upkuajing.com/)
Wait for user selection;

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements API key issuance, account balance lookup, pricing queries, and recharge-order creation, which are unrelated to an email-validity skill's stated purpose. In a skill context, bundling account-management and billing capabilities expands the attack surface and creates opportunities for unauthorized financial or credential-related actions if the skill is invoked unexpectedly or repurposed.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 17)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 21)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The code writes the issued API key directly to a .env file in plaintext, which can expose the secret to other local users, backups, shell tooling, or accidental inclusion in support bundles. In a skill that already exceeds its expected scope, plaintext credential persistence increases the chance that a sensitive token can be reused or stolen.

Content

Scanner excerpt · scripts/auth.py (reported line 70)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The returned error includes the environment-file path and encourages manual environment-variable setup after key issuance, which increases the chance of insecure secret handling. While not direct credential exfiltration, it contributes to unsafe operational practices around a sensitive API key.

Content

Scanner excerpt · scripts/auth.py (reported line 77)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code exposes account information, pricing, and recharge-order creation functionality that is unjustified for email validation. In this context, those operations are dangerous because they enable financial/account interactions beyond user expectations, increasing the risk of misuse, social engineering, or unauthorized billing-related activity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for verifying email validity/format and reducing bounce rates, but this module is built around a generic external API base URL, API-key authentication, and persistent task storage unrelated to any email-specific logic. Nothing in this file indicates email syntax checking, domain/mailbox verification, or list-scrubbing semantics; instead it provides infrastructure for a broader API integration.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends error details, including request identifiers, request path, and arbitrary context, to a remote platform endpoint even though that behavior is not necessary for core email-validation functionality. In a security review, this is risky because exception-reporting channels can exfiltrate operational or user-supplied data without clear minimization, consent, or purpose limitation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and requires capabilities including environment access, local file reads/writes, and network access, but it does not declare any explicit tool scope or permission boundaries. That makes review and enforcement harder and increases the chance that the skill can access credentials or modify local state beyond what a user would reasonably expect from an email-validation utility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description lists triggers such as "reduce email bounce rate," "CRM data cleansing," and "cold outreach optimization," which describe broad business goals rather than specific invocation phrases. Without clearer scope or exclusion conditions, these terms could cause unintended activation for general discussion about outreach or CRM hygiene.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file presents all user-facing documentation in Chinese and does not provide an English alternative, a language selection mechanism, or any justification that the skill is intended only for a Chinese-language audience. That can violate language/locale policy when users are not given an explicit opt-in or the locale restriction is undocumented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document instructs reporting errors to an external API and explicitly allows sending request parameters, response data, and exception context. Even though it claims sensitive fields are auto-masked, there is no clear user warning, consent flow, data-minimization requirement, or precise definition of what is redacted, creating a real risk of unintended disclosure of personal data, API payloads, and internal stack traces.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Using require_auth=False for API key creation is an unsafe default because it weakens trust boundaries around credential issuance. In the context of an unrelated email-validation skill, exposing unauthenticated credential enrollment is especially suspicious because it introduces privileged account bootstrap behavior with no obvious business need here.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Using require_auth=False for API key creation is an unsafe default because it weakens trust boundaries around credential issuance. In the context of an unrelated email-validation skill, exposing unauthenticated credential enrollment is especially suspicious because it introduces privileged account bootstrap behavior with no obvious business need here.

Content

Scanner excerpt · scripts/auth.py (reported line 40)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The function creates a recharge/payment order and returns a payment URL without any explicit warning, confirmation, or friction indicating that a billing action is being initiated. In an agent skill, silent initiation of payment-related flows can mislead users and facilitate accidental or unauthorized spending.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module header and user-facing strings are entirely in Chinese, and helper functions such as error messages and guidance print only Chinese text. This indicates a language-specific behavior without any visible mechanism for user language choice or opt-in, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196