支持海外公司内部校友列表查询，按公司 ID 与人员 ID 从全球公司数据库找校友与昔日同事。帮助招聘人员、销售团队与 B2B线索构建者发掘职业关系网、追溯职业履历、扩展联系清单——适合人才寻源、背调调研与人脉关系分析。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches a paid alumni lookup tool, but its credential handling is unsafe enough to require review before installation.

Install only if you are comfortable with a paid third-party API client that stores its API key under your home directory. Do not follow the `cat ~/.upkuajing/.env` instruction in a shared transcript; check key presence without printing it, protect the file with owner-only permissions, and require explicit confirmation before paid queries or recharge actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

Skill instructions encourage disclosure of the complete API key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-45
Vulnerability Type: Credential disclosure through unsafe operational instructions
Risk Level: High

Vulnerable Code

bash

cat ~/.upkuajing/.env

The documented file format confirms that this command outputs the API credential:

text

UPKUAJING_API_KEY=your_api_key_here

Technical Analysis

The Skill explicitly instructs the agent or operator to display the entire credential file. In an agent environment, command output may be copied into the conversation, tool transcript, telemetry, debug logs, or execution history.

Reading the fixed application-specific credential file is necessary only when the environment variable is unavailable. Displaying its complete contents is not necessary to establish whether the key exists. This behavior therefore exceeds the minimum access and disclosure needed for the declared alumni-query functionality.

The file may also contain additional configuration values beyond the API key. The command displays all of them without filtering or redaction.

Attack Path

1. A user asks the agent to configure or troubleshoot authentication.
2. The agent follows the Skill instructions and executes cat ~/.upkuajing/.env.
3. The shell returns the complete API key in tool output.
4. The credential is retained in the conversation transcript, logs, monitoring systems, or other systems that can access tool results.
5. A party with access to those records extracts the Bearer token.
6. The party uses the token against https://openapi.upkuajing.com to invoke authenticated APIs.

Impact Assessment

Exposure grants the attacker the same API authorization represented by the key. Based on the audited scripts, this can include paid alumni searches, retrieval of account information, pricing requests, creation of recharge-payment URLs, and authenticated error reports.

Unauthorized paid calls can consume ...[truncated 224 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to print the credential file.
• Check only for presence without displaying the value, for example by using a small trusted script that returns a Boolean status.
• Prefer UPKUAJING_API_KEY supplied through the execution environment or a platform-managed secret store.
• If diagnostics must mention a key, reveal no portion of it or use a short irreversible fingerprint.
• Add an explicit instruction that credentials must never be included in prompts, tool output, error reports, or logs.
• Treat previously displayed keys as compromised: revoke them, issue replacements, and remove them from retained transcripts and logs where possible.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:61

Finding

API key file is created without enforcing restrictive filesystem permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 61-74
Additional Relevant Location: scripts/common.py, lines 18-19 and 63-103
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Vulnerable Code

python

try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")
except IOError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but saving the environment file failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

The shared code later reads this plaintext file as the authentication fallback:

python

UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'

if UPKUAJING_ENV_FILE.exists():
    with open(UPKUAJING_ENV_FILE, 'r', encoding='utf-8') as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith('#'):
                continue
            if '=' in line:
                key, value = line.split('=', 1)
                env_vars[key.strip()] = value.strip()

Technical Analysis

The API key is written in plaintext with the process's default file-creation mode. The code does not request owner-only permissions, call chmod, verify the resulting mode, or reject unsafe pre-existing files.

On a typical POSIX system using a permissive umask such as 022, a file opened this way may be created with mode 0644. The enclosing directory may similarly be created as 0755. Other local users could therefore read the credential. The actual resulting permissions depend on the host's umask and ...[truncated 1401 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer a platform-managed secret store or operating-system credential manager instead of a plaintext environment file.
• On POSIX systems, create the directory with owner-only permissions and verify them:
  • Directory mode: 0700
  • Credential-file mode: 0600
• Create the file atomically with exclusive and restrictive flags, such as os.open using O_CREAT | O_EXCL | O_WRONLY and mode 0o600.
• If an existing file must be updated, verify that it is a regular file owned by the current user and is not a symbolic link.
• Write to a securely created temporary file in the same directory and atomically replace the destination.
• Refuse to use the credential file when group or other read permissions are present, and provide a safe repair command.
• Avoid printing any portion of an existing key during duplicate-key checks.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency specification permits unreviewed future httpx releases

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unbounded and non-reproducible third-party dependency
Risk Level: Low

Vulnerable Code

text

httpx>=0.23.0

Technical Analysis

The dependency uses only a minimum version and provides neither an upper bound nor an exact version. It also lacks an integrity hash or lock file. Consequently, installations performed at different times can resolve to materially different releases, including a future major version that has not been tested or audited with this Skill.

This does not prove that the current httpx package is malicious. The security concern is that the audited artifact does not define a reproducible dependency set. A future compromised release, compromised package index, or incompatible release could execute during import or alter TLS and HTTP behavior while the library handles API credentials and personal-data responses.

Attack Path

1. An operator installs dependencies with pip install -r requirements.txt.
2. The resolver selects the newest release satisfying the unbounded constraint.
3. A future release is compromised, maliciously replaced in the configured package index, or contains a relevant vulnerability.
4. The package executes in the Skill process when imported by common.py or version_check.py.
5. Malicious dependency code can access the process environment, the plaintext API-key file, request parameters, API responses, and the user's filesystem subject to the process account's permissions.

This path is conditional on a compromised or vulnerable resolved package; no such malicious package was identified in the supplied project.

Impact Assessment

Dependency code runs with the same operating-system privileges as the Skill. A compromised package could steal the API key, modify requests, expose alumni-query results, alter version-check traffic, or access other files available to th ...[truncated 300 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a reviewed exact version.
• Generate and commit a reproducible lock file containing transitive dependency versions.
• Require package hashes during installation, for example through a hash-locked requirements file and pip --require-hashes.
• Upgrade dependencies through a controlled review process with automated vulnerability scanning and compatibility tests.
• Use only trusted package indexes and prevent fallback to untrusted or attacker-controlled indexes.
• Periodically update the reviewed pin rather than relying indefinitely on an old version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform version checks, local cache reads/writes, and parsing of local metadata while presenting itself as a simple alumni lookup tool. Those auxiliary behaviors create additional network and file-system touchpoints that are not obvious from the high-level description, increasing the attack surface and the chance of hidden data leakage or unexpected state changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill appears to perform version checks, local cache reads/writes, and parsing of local metadata while presenting itself as a simple alumni lookup tool. Those auxiliary behaviors create additional network and file-system touchpoints that are not obvious from the high-level description, increasing the attack surface and the chance of hidden data leakage or unexpected state changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform version checks, local cache reads/writes, and parsing of local metadata while presenting itself as a simple alumni lookup tool. Those auxiliary behaviors create additional network and file-system touchpoints that are not obvious from the high-level description, increasing the attack surface and the chance of hidden data leakage or unexpected state changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill appears to perform version checks, local cache reads/writes, and parsing of local metadata while presenting itself as a simple alumni lookup tool. Those auxiliary behaviors create additional network and file-system touchpoints that are not obvious from the high-level description, increasing the attack surface and the chance of hidden data leakage or unexpected state changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill appears to perform version checks, local cache reads/writes, and parsing of local metadata while presenting itself as a simple alumni lookup tool. Those auxiliary behaviors create additional network and file-system touchpoints that are not obvious from the high-level description, increasing the attack surface and the chance of hidden data leakage or unexpected state changes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill instructs reading the entire ~/.upkuajing/.env file with cat to obtain an API key. Directly accessing and potentially exposing a secrets file is dangerous because .env files often contain multiple credentials, and displaying or handling them in plaintext can leak secrets to logs, chat transcripts, or downstream tools.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The documented workflow checks for a local API key and, if absent, allows the skill to request a new key and automatically save it to ~/.upkuajing/.env. This combines credential creation with local secret persistence in a broadly accessible plaintext location, which increases the chance of unauthorized reuse, disclosure, or accidental cross-skill access.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill explicitly directs checking and populating ~/.upkuajing/.env for UPKUAJING_API_KEY, reinforcing a pattern of plaintext secret discovery and storage. In the context of a skill that also performs network actions and billing-related workflows, this makes secret handling more dangerous because compromised or overly broad tool access could expose credentials and enable unauthorized API usage or charges.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements API key provisioning, account inspection, and payment-related operations that are not necessary for a skill advertised as alumni/employee search. This mismatch expands the skill's privileges and introduces billing and credential-handling behavior that users and reviewers would not reasonably expect, increasing the risk of unauthorized account operations or deceptive monetization.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code writes a newly issued API key directly to a plaintext .env file under the user's home directory. Plaintext secret storage increases the chance of leakage through weak filesystem permissions, backups, accidental sharing, or other local compromise; in this skill's context, that secret can authorize further account/API actions.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The error path instructs the user to manually set the API key environment variable, which can encourage insecure handling of secrets via shell history, process listings, screenshots, or copied commands. In a skill already performing account and billing operations, promoting ad hoc secret handling increases credential exposure risk.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI exposes account balance, pricing, and recharge-order creation features, which are operational/account-management capabilities unrelated to alumni discovery. In the context of a business-contacting skill, these hidden billing functions increase the blast radius from data access to financial/account actions and can be abused or surprise users with unintended charges or account linkage.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for querying a global company database to find alumni and former employees for business networking. In contrast, this code validates error-report parameters and sends them to an '/agent/skill/error/report' endpoint, which is operational telemetry unrelated to personnel discovery or company-history analysis.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents capabilities to read environment variables, read and write local files such as ~/.upkuajing/.env, and make network requests, but it does not declare any explicit tool scope or permission boundaries. That weakens reviewability and increases the chance that a caller or hosting platform will grant broader access than is necessary, especially because the same document also discusses credential handling and remote API operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill can retrieve both '校友' and '离职前员工名单' for a target company, implying broader historical personnel tracing. However, the documentation and usage examples only cover querying alumni by person ID and school ID via person_alumni_list.py, with no documented former-employee or company-level employee-history capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description and operating instructions are fully presented in Chinese, and the file does not provide an opt-in language choice or state that the skill is limited to Chinese-speaking users for a documented regional reason. This can violate language/locale policy by forcing a specific language on users without explicit consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and user-facing descriptions are entirely in Chinese, which imposes a specific language on users without any visible opt-in or explanation that the skill is region- or language-specific. The policy calls for flagging language or locale constraints unless the skill offers a choice or clearly justifies the restriction.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196