支持海外企业员工信息查询 / 公司人员名单查询，按公司 ID从海外企业数据库获取员工名单、职位、职级与部门。帮助招聘人员、销售团队、B2B线索构建者、丰富联系人与职位数据——适合人才调研、竞品组织分析、关键人（决策人）定位与线索资格筛选，适用于找采购/技术决策人、招聘挖角与销售线索

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.6

Overview

The skill mostly matches a paid employee-lookup service, but it exposes API-key handling and billing workflows in ways users should review carefully before installing.

Install only if you are comfortable with a paid third-party API skill that can use and store an UPKUAJING API key, create recharge payment links, and send confirmed error reports. Do not let the agent print your .env file; prefer setting the API key through a secure environment or secret manager, and review payment/order actions before approving them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Credential Disclosure Through Documented File Printing

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:63

Finding

API Key File Is Created Without Explicitly Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Permits Unreviewed Future Releases

Content

View full analysis

=0.23.0 ``` The documented installation procedure executes: ```bash pip install -r requirements.txt ``` ### Technical Analysis The lower-bound-only constraint allows pip to install any compatible future `httpx` release selected by the configured package index. The resulting installation is not reproducible and may differ materially from the dependency version considered during this audit. This is not evidence that the current `httpx` package is malicious. The risk is that a future compromised, malicious, or incompatible release could be installed without another review. Package installation and later imports execute code outside the audited project. ### Attack Path 1. A user follows the documented dependency installation procedure. 2. Pip resolves the newest release satisfying `httpx>=0.23.0`. 3. The resolved artifact is newer than the version reviewed or tested by the Skill author. 4. If that release or the configured package index is compromised, package installation or import executes attacker-controlled code. 5. The code runs with the privileges of the user installing or invoking the Skill. ### Impact Assessment A compromised dependency could potentially access all files, environment variables, and network resources available to the Python process, including `UPKUAJING_API_KEY`. If installation is performed with elevated privileges, the potential scope increases accordingly. No dependency compromise is demonstrated in the audited artifact; this finding concerns avoidable exposure and lack of reproducibility. ]]>

Remediation

View remediation

other

Note

• Location: scripts/common.py:199

Finding

Automatic Version Check Sends Skill Identity and Writes Persistent Cache Without Documentation

Content

View full analysis

Optional[str]: try: url = f"{api_base_url}/agent/api/skills/version" headers = {"Content-Type": "application/json"} with httpx.Client(timeout=10.0) as client: response = client.post( url, json={"name": skill_name}, headers=headers ) response.raise_for_status() data = response.json() if data.get("code") == 0: return data.get("data") except Exception as e: print(f"Error checking skill version:{e}", file=sys.stderr) return None ``` A successful check is recorded under the user's home directory: ```python cache[skill_name] = { "last_check_date": today, "latest_version": latest_version } save_version_cache(cache) ``` ### Technical Analysis The first API operation of the day may perform an additional unauthenticated request to `/agent/api/skills/version`, transmitting a Skill identifier derived from the local installation directory. It also creates or updates `~/.upkuajing/version_cache.json`. This behavior is not required to perform employee lookup and is not disclosed in the Skill instructions. It does not transmit the API key and does not download or execute an update. Therefore, it is not remote payload execution or system persistence in the backdoor sense; it is an undocumented telemetry and local-state side effect. ### Attack Path 1. A u ...[truncated 866 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The advertised purpose is employee lookup, but the skill also includes API-key provisioning, local secret persistence, account inspection, billing flows, and payment-order creation. This mismatch is dangerous because users may consent to a data lookup skill without realizing it can trigger account-affecting and credential-management operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The advertised purpose is employee lookup, but the skill also includes API-key provisioning, local secret persistence, account inspection, billing flows, and payment-order creation. This mismatch is dangerous because users may consent to a data lookup skill without realizing it can trigger account-affecting and credential-management operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The advertised purpose is employee lookup, but the skill also includes API-key provisioning, local secret persistence, account inspection, billing flows, and payment-order creation. This mismatch is dangerous because users may consent to a data lookup skill without realizing it can trigger account-affecting and credential-management operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The advertised purpose is employee lookup, but the skill also includes API-key provisioning, local secret persistence, account inspection, billing flows, and payment-order creation. This mismatch is dangerous because users may consent to a data lookup skill without realizing it can trigger account-affecting and credential-management operations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly instructs reading a local credential file with a shell command, exposing the API key stored in ~/.upkuajing/.env. Directly surfacing secrets from local files is dangerous because it normalizes credential disclosure and creates a clear path to accidental exfiltration or misuse by the skill runtime or downstream outputs.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill directs the system to inspect a local .env file for the API key and to write newly issued credentials there automatically. Reading and writing secrets in a plain-text local file increases exposure risk, especially in agent environments where file access may be broader than the user expects.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Automatically applying for a new API key and saving it to ~/.upkuajing/.env combines credential creation with local secret persistence, which can lead to unreviewed account changes and secret sprawl. In the context of a skill advertised for employee lookup, this makes the behavior more dangerous because users may not anticipate credential lifecycle operations at all.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is an authentication and billing management script that can create API keys, query balances, create recharge orders, and fetch pricing, which materially exceeds the declared skill purpose of employee/headcount lookup. In an agent skill context, hidden or unnecessary account-management capabilities increase attack surface and can enable unintended financial or credential-related actions if exposed to users or chained by other components.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The script deliberately checks for and manages API credentials in a .env file under the user’s home directory. Storing long-lived secrets in plaintext local files increases exposure to local compromise, accidental inclusion in backups, or leakage through permissive file permissions; in this skill, that risk is more concerning because credential management is unrelated to the declared employee-lookup function.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Reading an existing .env to retrieve API-key material is credential-handling behavior that expands the skill’s access to secrets. Although the code only checks for presence, it still processes plaintext secret data from disk, which is risky when bundled into a skill whose stated purpose is unrelated to authentication or secret management.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The code writes a newly issued API key directly to a .env file in plaintext. Plaintext persistence of active API credentials can lead to credential theft through local malware, shared environments, misconfigured permissions, or accidental syncing/logging, enabling unauthorized API use and account abuse.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The new_rec_order() function creates recharge/payment orders even though the skill is described as an employee information lookup tool. Payment initiation is a sensitive financial capability; when embedded in an unrelated skill, it creates unjustified risk of abuse, deceptive functionality, or accidental charges.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares executable behavior that can read environment variables, read/write local files, and access the network, yet it provides no explicit tool-scope or permission boundary. That omission increases the blast radius of misuse because a consumer cannot easily tell that credential files, local state, and remote endpoints may all be touched during normal operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill description is written as a Chinese-only audience/purpose statement and the file provides no option for the user to choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly allows sending request parameters, response data, and error context to a remote error-reporting API. Even though it says sensitive fields will be desensitized automatically, it provides no concrete data-handling limits, user warning, consent flow, or guarantee that all secrets, personal data, and business-sensitive content will be removed before transmission. In the context of a skill that processes employee and company information, diagnostic payloads may contain personal or confidential data, making off-box reporting a real privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains user-facing natural-language descriptions and help text that assume Chinese-only usage. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Account balance and platform pricing queries are not aligned with the stated purpose of enumerating employees and org structure. While less severe than payment creation, these functions expose financial/account metadata that can aid reconnaissance about the tenant’s usage, credits, or monetization setup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The argparse description, option help text, and printed status/error messages are all in Chinese, with no language selection mechanism. This enforces a single language for user interaction and does not offer a choice or explain a necessary locale constraint.

Content

No source excerpt is available for this finding.