Retrieve overseas corporate employee records and internal staff rosters via targeted company ID lookup queries. Pull employee names, job titles, senioritylevels and department profiles from global enterprise databases. Recruiters, sales teams and B2B lead generation specialists streamline contact enrichment andjob position data validation workflows. Streamline talent mapping, competitor organizational chart analysis and decision-maker targeting for lead qualification.Quickly pinpoint procurement and technical core stakeholders to streamline headhunting recruitment and B2B sales lead development.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.6

Overview

This skill performs the advertised employee lookup, but it also handles plaintext API keys, account payments, diagnostic reporting, and an undisclosed version-check cache in ways users should review carefully.

Install only if you are comfortable using UpKuaJing's paid API for employee-profile data. Do not print or paste your API key, review any top-up/payment action before approving it, and avoid sending raw prompts, employee data, tokens, or full responses in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

API Key Exposed Through Documented Terminal Command

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:65

Finding

Credential File Is Created Without Explicitly Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Open-Ended Dependency Version Allows Unreviewed Future Releases

Content

View full analysis

=0.23.0 ``` The project directs installation with: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement specifies only a minimum version and has no upper bound, exact version, lock file, or package hash. A fresh installation can therefore resolve to a future `httpx` release and to changing versions of its transitive dependencies without project review. This does not prove that the current package is malicious. The risk is that installation behavior and runtime code are not reproducible: a compromised, unexpectedly changed, or incompatible future release could be selected automatically. Python package installation may also execute build backend behavior when a source distribution is used. ### Attack Path 1. A user follows `SKILL.md` and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest release satisfying `httpx>=0.23.0`, along with dynamically resolved transitive dependencies. 3. If a selected future release or dependency is compromised, malicious build or package code executes during installation or later import. 4. That code runs with the privileges of the user installing or invoking the Skill. 5. It may access files, environment variables, and network resources available to that user, including the API key when the Skill is run. This path depends on a future dependency compromise or malicious release; none was identified in the reviewed project. ### Impact Assessment If the dependency supply chain is compromised, code can execute with the installing user's privileges. Potential exposure includes the user's files, environment variables, API credentials, and network access. The current evidence establishes a reproducibility and supply-chain-hardening weakness, not an active malicious dependency. ]] ...[truncated 1 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates undocumented update/version checking, cache reads/writes, and contact with version APIs unrelated to employee lookup. Even if benign, hidden network and filesystem behaviors expand the attack surface and can enable tracking, data persistence, or execution flows users did not expect from the stated function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates undocumented update/version checking, cache reads/writes, and contact with version APIs unrelated to employee lookup. Even if benign, hidden network and filesystem behaviors expand the attack surface and can enable tracking, data persistence, or execution flows users did not expect from the stated function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates undocumented update/version checking, cache reads/writes, and contact with version APIs unrelated to employee lookup. Even if benign, hidden network and filesystem behaviors expand the attack surface and can enable tracking, data persistence, or execution flows users did not expect from the stated function.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading a home-directory .env file containing an API key. Direct access to local credential files is dangerous because it normalizes secret exposure and can lead to accidental disclosure of the key contents to the model, logs, or downstream tooling.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The workflow asks the agent to check for and potentially populate credentials in ~/.upkuajing/.env, including obtaining a new key and auto-saving it locally. This combines credential discovery, creation, and persistence in a user-home path, which can expose secrets and exceeds the expectations of a simple data-lookup skill.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly encourages manual editing and automatic saving of API keys into a local .env file. Persisting secrets in predictable plaintext locations increases the risk of credential theft by other tools, users, logs, backups, or future prompts that read local files.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements authentication and billing management features even though the skill is ներկայացված as an employee-profile lookup tool. This scope mismatch is dangerous because it expands the skill's authority and attack surface beyond user expectations, enabling account provisioning and financial operations that are unrelated to the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The code explicitly targets a local .env file for credential handling, signaling disk-based secret persistence. Storing API keys in plaintext configuration files is dangerous because such files are commonly exposed through backups, misconfigured permissions, logs, or accidental source control inclusion.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Reading an existing .env file to inspect stored API keys confirms the skill relies on local plaintext secret material. This pattern is risky because any process with file access can harvest the credential, and the code normalizes secret retrieval outside stronger platform-managed secret controls.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Writing the newly created API key directly to a .env file stores a sensitive credential in plaintext on disk. This is dangerous because it creates a durable secret artifact that may be readable by other users, captured by backups, or accidentally committed or exfiltrated.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The failure path instructs users to set the API key manually as an environment variable, continuing an insecure pattern of ad hoc secret handling. While environment variables can be acceptable in some deployments, treating them as a fallback without secure handling guidance increases the chance of exposure through process listings, shell history, crash reports, or CI logs.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Creating recharge orders is unrelated to employee search and introduces a financial operation into a data-retrieval skill. That makes the skill more dangerous because a user or downstream agent invoking it for lookup purposes could unexpectedly trigger payment-related actions or expose billing endpoints.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code adds an error-telemetry pathway that reports Agent/Skill execution failures to a platform endpoint, even though the stated skill purpose is overseas employee-profile lookup. Because the payload includes operational metadata and context, it creates a secondary data flow unrelated to the business function and can expose sensitive request details during failures.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function sends requestId, requestPath, and especially free-form context to a remote '/agent/skill/error/report' endpoint without any visible filtering or justification tied to the skill’s business purpose. If context contains prompts, user data, employee data, tokens, or internal errors, those details may be exfiltrated to an external service during exception handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares capabilities that involve environment variables, filesystem access, and network calls, but it does not constrain tool scope with explicit permissions or allowed-tools. In practice, this gives the skill broad operational latitude to read local secrets, modify files, and contact remote services without clear least-privilege boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough to activate on common recruiting, business analysis, and lead-generation requests. In this context, that increases the chance of the skill being invoked opportunistically to pull employee profile data in situations where the user did not explicitly request this specific data source or understand the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is designed to retrieve employee profile information for recruitment and B2B lead generation but does not present a clear privacy warning or data-handling notice. Because the subject matter is employee data and decision-maker identification, the lack of notice makes misuse and over-collection more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The API documentation explicitly permits uploading raw request parameters, response bodies, and exception context for debugging, which commonly contain personal data, internal identifiers, tokens, or other sensitive business information. Although it notes that sensitive fields are 'automatically desensitized,' it does not define what is scrubbed, require minimization, or warn operators not to include secrets/PII, creating a realistic risk of oversharing employee or customer data into centralized logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and all user-facing help/messages in this file are written only in Chinese, which imposes a specific language on users. The policy allows fixed locale behavior only when the constraint is explicitly justified or when users are given a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code provisions new API keys and persists them locally in a .env file, which is beyond the stated recruiting/lead-generation purpose. Unnecessary credential creation and storage increase the risk of secret leakage, unauthorized reuse, and privilege expansion if the host or workspace is compromised.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Using require_auth=False for key creation establishes an unsafe default on a sensitive operation. In the context of a skill that should only perform employee-profile lookup, this makes the mismatch more dangerous by permitting unauthenticated credential provisioning through an unexpectedly broad interface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60