Validates email addresses by checking format compliance and active-or-inactive status. Ithelps sales teams, recruiters and marketers confirm email authenticity, lower bounce ratesand boost cold-outreach performance. This indispensable tool delivers CRM data cleansing,candidate screening, supplier verification and email-list scrubbing. It works for pre-sendcleanup before bulk foreign-trade email campaigns, recruitment background checks and buyervalidation.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:50 AM UTC
• Version: 1.0.2

Overview

The skill mainly does email validation, but it also handles API keys, paid account flows, and under-disclosed outbound update/reporting behavior that users should review before installing.

Install only if you are comfortable sending email addresses to UpKuaJing's remote API and storing the API key locally in plaintext. Confirm any fee-incurring validation or recharge action before it runs, avoid enabling request/response logging for sensitive lists, and review the automatic version-check behavior if your environment restricts outbound network calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares no permissions while its documented behavior requires environment access, local file reads/writes, and network calls. This under-disclosure is dangerous because it prevents users and platforms from making an informed trust decision and hides the real data exposure surface, including credential handling and outbound transmission of email addresses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The advertised purpose is simple email validation, but the skill also performs account management, pricing queries, payment/recharge flows, credential storage guidance, error reporting, and version/network metadata handling. This mismatch broadens the attack and privacy surface beyond user expectations, increasing the risk of sensitive data disclosure, unexpected charges, or user manipulation into unrelated actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements API key provisioning, account lookup, recharge-order creation, and pricing retrieval, which are materially unrelated to an email-validity skill. In a skill context, this expands the trust boundary and introduces financial/account-management capabilities that could be abused if the skill is invoked or repurposed unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The ability to create recharge/payment orders is unrelated to verifying email validity and introduces direct financial functionality into a low-trust skill surface. If exposed through an agent workflow, it could trigger unwanted billing actions or facilitate abuse of a linked account.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Exposing account balances, platform account identifiers, and pricing data is outside the stated purpose of email validation and leaks operational and financial metadata. While not as severe as payment creation, this information can aid profiling, account targeting, or social-engineering against the operator.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The utility is wired to a cross-border commerce API and local account/config paths that do not align with the declared email-validation purpose. This scope mismatch is dangerous because it gives the skill undeclared remote-access and account-coupled capabilities, increasing the chance of data exfiltration, misuse of third-party accounts, or user deception about what the skill actually does.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code includes balance-related and recharge guidance for a third-party service, which is unrelated to email validation. Unnecessary account-management functionality expands operational scope and can facilitate unintended billing actions or conceal that the skill interacts with a monetized external platform.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: The unconditional version-check callback introduces extra outbound network activity beyond the stated email-validation purpose. Even if benign, silent call-home behavior can leak usage metadata and creates an undeclared dependency on a remote service.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The script sends exception-report data, including requestPath, requestId, and arbitrary context, to a remote platform endpoint even though the skill is presented as an email-validation tool. That mismatch increases the risk of undisclosed data exfiltration or collection of sensitive operational details, especially because the context field may contain error text, inputs, or other metadata from calling workflows.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: This file implements platform exception reporting rather than email-validity checking described in the manifest, indicating a capability mismatch. While not inherently exploit code, hidden off-purpose functionality in a skill is risky because it can transmit data or perform actions users do not expect from the declared feature set.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The module makes outbound HTTP requests to a server-defined endpoint and writes persistent state under the user's home directory, behavior that is unrelated to the stated purpose of email validation. Even if intended for update checks, this expands the skill's trust boundary by introducing telemetry-like network activity and disk persistence, which can leak usage metadata, create supply-chain risk, and surprise users in environments that expect an offline or single-purpose validator.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill does not clearly warn that submitted email addresses will be sent to an external API. Because email addresses are often personal or business-sensitive data, lack of explicit disclosure undermines informed consent and creates privacy/compliance risk, especially for bulk contact-list processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes sending email addresses and a bearer token to an external API but does not warn about privacy, consent, retention, or third-party data handling. Because email addresses are personal data and authentication tokens are sensitive credentials, this omission can lead users to transmit regulated or confidential data without understanding the security and compliance implications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The request/response logging functions can persist transmitted parameters and API responses to local files, which may include email addresses, API data, or other sensitive content. Even though logging is currently disabled by default, the feature lacks sanitization, retention controls, or user-facing disclosure, so enabling it would create a local data-leak risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends user-supplied email addresses to a remote endpoint via make_request('/agent/validation/email', params) without any explicit disclosure, confirmation, or privacy notice at the point of use. Email addresses are personal or sensitive business contact data, so silent transmission can create privacy, compliance, and data-handling risks, especially when users may assume validation is local.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code forwards request context to a network endpoint without any disclosure, warning, or visible safeguards in this file. If context contains stack traces, user content, API payloads, or identifiers, this can leak sensitive information to a third party and violate user expectations or privacy requirements.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 85% confidence
• Finding: Writing a newly issued API key directly into a plaintext .env file creates a recoverable local secret at a predictable location. If file permissions are weak, backups are exposed, or other local processes can read the file, the key can be stolen and reused against the account.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 82% confidence
• Finding: The error path encourages manual environment-variable handling for the API key, which can lead users to place secrets into shell history, process environments, or insecure config files. Combined with plaintext key management elsewhere in the file, this increases the chance of accidental credential exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 89% confidence
• Finding: The dependency is specified with a lower-bound constraint only (`httpx>=0.23.0`), which allows installation of any future version, including releases with breaking changes or newly introduced vulnerabilities. This weakens build reproducibility and can unintentionally pull in unsafe or incompatible versions during deployment or later reinstalls.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: The explicit use of require_auth=False on the credential-provisioning request establishes an unsafe default for a sensitive operation. Even if the upstream service permits anonymous signup, embedding that behavior here makes a non-email-validation skill capable of silently expanding account access.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: The explicit use of require_auth=False on the credential-provisioning request establishes an unsafe default for a sensitive operation. Even if the upstream service permits anonymous signup, embedding that behavior here makes a non-email-validation skill capable of silently expanding account access.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196