支持海外公司内部校友列表查询，按公司 ID 与人员 ID 从全球公司数据库找校友与昔日同事。帮助招聘人员、销售团队与 B2B线索构建者发掘职业关系网、追溯职业履历、扩展联系清单——适合人才寻源、背调调研与人脉关系分析。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:37 AM UTC
• Version: 1.0.5

Overview

This looks like a real paid alumni-search API skill, but it needs review because it stores API keys in a local plaintext file and includes under-disclosed support/version network calls.

Install only if you are comfortable with this skill contacting Upkuajing services, using billable API calls after confirmation, storing an API key in ~/.upkuajing/.env, and optionally sending error details to the provider. Avoid pasting or displaying the API key, and review any error report content before allowing it to be sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior includes reading environment variables, accessing local files under ~/.upkuajing, writing API keys, and making network requests. This mismatch weakens user consent and platform controls because sensitive capabilities are exposed without being transparently declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is alumni lookup, but the skill also performs account lifecycle and billing operations such as creating API keys, storing credentials locally, retrieving account info, creating recharge orders, checking pricing, reporting errors, and version caching. This is dangerous because a user invoking a data lookup skill may unknowingly trigger credential provisioning, payment-related actions, or telemetry beyond the advertised scope.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The script implements outbound error telemetry, which does not align with the stated business purpose of identifying alumni and former employees. In a skill that may process company- and user-supplied data, this capability creates an undeclared data-flow path to an external platform and increases the risk of sending sensitive request context unrelated to the advertised function.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code sends `requestId`, `requestPath`, and arbitrary `context` to `/agent/skill/error/report`, giving the skill a generic exfiltration channel for runtime information. Because `context` is only checked for presence and not sanitized or bounded, operational errors could leak user data, internal paths, prompts, or system details beyond what is necessary for the alumni-search use case.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs outbound network access and local filesystem writes for version-checking, which is unrelated to the stated alumni/personnel discovery purpose. While not overtly malicious, hidden ancillary behaviors increase attack surface, create undeclared data flows, and can be abused if the configured API endpoint is compromised or unexpectedly points to an untrusted host.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill includes self-update checking capability that is not justified by its declared business function. In a security review, unnecessary control-plane behavior inside a data-retrieval skill is risky because it normalizes covert communication paths and can later be extended to fetch or influence code/content outside the user’s expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs agents to send request parameters, response data, and exception context to an error-reporting API, which can easily include personal data, credentials, internal identifiers, or business-sensitive content. Although the text says sensitive fields will be auto-masked, it does not define what is masked, does not require pre-send minimization, and provides no explicit warning or prohibition against including secrets or unnecessary user data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The network submission occurs without any user-facing disclosure, consent, or indication that runtime context may be transmitted externally. In a skill that may handle business relationship research and related inputs, undisclosed telemetry can expose confidential operational or user-provided information and violate least-surprise and privacy expectations.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The code automatically sends the skill name to a remote API during normal operation without a clear user-facing warning or consent flow. Although the transmitted field is limited, silent telemetry is still a privacy and transparency issue, especially because users would not expect a personnel-discovery skill to contact an update endpoint automatically.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs reading and writing API keys in ~/.upkuajing/.env and offers to auto-apply for a new key and persist it locally. Accessing credential files and storing secrets in a generic local path increases the risk of credential disclosure, accidental exfiltration, or reuse by other tools without the user's fully informed consent.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This section continues the credential-handling workflow by checking for UPKUAJING_API_KEY in a local .env file and automatically saving newly issued keys there. Such behavior expands the blast radius of secret exposure because local plaintext storage and scripted provisioning can be abused by compromised skills or shared environments.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: The script writes a newly issued API key directly into a plaintext .env file under the user’s home directory without any visible permission hardening. If the file is readable by other local users, included in backups, or accidentally committed/synced, the API key can be stolen and abused for account access or billable API usage.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 74% confidence
• Finding: The error path exposes the exact environment variable name and filesystem path for secret storage. While not severe on its own, revealing secret locations can aid local attackers or malware in targeting credential files, especially because the same script stores the API key in plaintext.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including major releases with breaking changes or versions that may later introduce vulnerable transitive dependencies. This weakens build reproducibility and can cause the skill to pick up unsafe or unreviewed packages over time, especially for a network-facing HTTP client library.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196