支持海外企业员工信息查询 / 公司人员名单查询，按公司 ID从海外企业数据库获取员工名单、职位、职级与部门。帮助招聘人员、销售团队、B2B线索构建者、丰富联系人与职位数据——适合人才调研、竞品组织分析、关键人（决策人）定位与线索资格筛选，适用于找采购/技术决策人、招聘挖角与销售线索

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:20 AM UTC
• Version: 1.0.6

Overview

This is a coherent paid Upkuajing API skill for employee lookup, with disclosed credential and billing helpers plus a limited under-disclosed version check.

Install this only if you intend to use Upkuajing's paid API. Treat UPKUAJING_API_KEY as a secret, avoid displaying or sharing ~/.upkuajing/.env, confirm each paid lookup or recharge step, and review any optional error report before sending it because it may include request or response details.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly includes reading environment data, accessing local files, writing to ~/.upkuajing/.env, and making network requests. This mismatch weakens user consent and platform policy enforcement because the skill can access sensitive resources beyond what its manifest transparently communicates.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is employee lookup, but the skill also instructs the agent to request and store API keys, inspect account information, create recharge orders and payment links, query pricing, report errors externally, and cache version data locally. This expands the operational scope into credential handling, billing, and external reporting, creating materially higher risk than users would expect from a simple employee search tool.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements API key issuance, account inspection, pricing lookup, and recharge-order creation, which materially exceeds the declared skill purpose of employee/headcount lookup. This capability expansion increases the attack surface and grants commercial/account-management functions unrelated to the user-facing scope, creating opportunity for misuse or unauthorized billing actions.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Recharge-order creation and account-balance management are sensitive commercial operations that are unrelated to the advertised employee lookup use case. Even if legitimate for platform onboarding, embedding them in this skill can surprise users and enable unintended financial actions through a broader-than-necessary interface.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This module performs outbound network requests to a remote API and writes persistent cache data under the user's home directory, despite the skill's stated purpose being employee/headcount lookup. That creates an unnecessary side effect and telemetry channel: merely invoking the skill can disclose the installed skill name and usage timing, and it expands the attack surface if the update endpoint or transport is abused.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code implements automatic daily version telemetry by deciding whether a check is needed and then contacting a server with the skill name. This behavior is not required for the advertised business function, so it represents unnecessary metadata exfiltration and covert background communication that could surprise users or violate least-privilege expectations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly encourages sending request parameters, response payloads, and exception context to an error-reporting API, but it does not require user notice, consent, minimization, or strict redaction guarantees. In this skill’s business context, those fields can plausibly contain personal data about employees, customer targets, or internal company information, so error reporting can become a secondary data exfiltration path even if it is framed as diagnostics.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The helper sends arbitrary caller-supplied parameters to an external API endpoint, but there is no built-in consent, redaction, or user-facing warning at the transmission point. In this skill’s context, the API is specifically used to query employee and organization data, so user inputs may contain personal, company-sensitive, or prospecting-related information that is silently exfiltrated to a third-party service.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill explicitly instructs reading and populating ~/.upkuajing/.env to obtain or store UPKUAJING_API_KEY, which involves direct access to local secret material. Encouraging automated inspection and persistence of credentials in a user home directory increases the risk of secret exposure, unintended reuse, or leakage through logs and downstream tooling.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: The follow-on instruction to apply for a new key and automatically save it into ~/.upkuajing/.env establishes a workflow for credential generation and local storage without strong separation of duties or secure secret handling. In the context of a sales/recruiting data skill, this is more dangerous because credential lifecycle management is unrelated to the core lookup task and broadens the attack surface around billing-enabled API access.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 76% confidence
• Finding: Writing the API key directly to a plaintext .env file under a user directory creates a local secret-exposure risk if filesystem permissions are weak, the directory is synced/shared, or other local processes/users can read it. While not credential theft by itself, this is an insecure secret-storage practice that can facilitate later compromise.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 72% confidence
• Finding: The error path encourages manual environment-variable handling for the API key, which can lead users to place secrets in shell history, process lists, or insecure configuration files. This is a weaker issue than exfiltration, but it still promotes insecure credential handling practices.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 91% confidence
• Finding: The dependency specification uses a lower-bound-only version range (`httpx>=0.23.0`), which allows future unreviewed releases to be installed. This creates supply-chain and stability risk because a later incompatible or vulnerable version could be pulled into the environment without explicit testing or approval.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196