ClawHub
Back to skill

Security audit

Identify corporate alumni and former coworkers via company ID and personnel ID lookups across global business databases. Generate complete alumni rosters forany target enterprise.Recruiters, sales teams and B2B lead generation specialists map professional networks, track career trajectories and expand contactdatabases at scale. Streamline talent sourcing, candidate background research and corporate partnership relationship analysis workflows.

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs the advertised paid alumni lookup, but it asks agents to expose a local API-key file and includes under-disclosed local credential, billing, telemetry, and version-check behavior that users should review before installing.

Review this skill before installing. Avoid running the documented `cat ~/.upkuajing/.env` command, keep the UpKuaJing API key in a dedicated file with restrictive permissions, and confirm any paid query, top-up, or error-reporting action only when you understand what data and costs are involved.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:40
Finding

Credential File Disclosure Through Full-File Inspection Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-49
Vulnerability Type: Credential disclosure and excessive secret-file access
Risk Level: High

Vulnerable Code

markdown
This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file content:

text
UPKUAJING_API_KEY=your_api_key_here

API Key Not Set

First check if the ~/.upkuajing/.env file has UPKUAJING_API_KEY;

text

### Technical Analysis

The Skill instructs the Agent to print the complete contents of a credential file to determine whether one specific variable exists. Although access to the UpKuaJing API key is necessary for authenticated requests, displaying the entire file is not required.

The command can disclose the API key and any unrelated secrets stored in the same file. The output may subsequently be captured in the Agent conversation, terminal scrollback, execution logs, monitoring systems, or other retained output. This exceeds least privilege because a non-disclosing existence check would be sufficient.

The Python implementation in `scripts/common.py` can retrieve the required key without printing it, so the full-file display instruction is unnecessary for the declared alumni-query functionality.

### Attack Path

1. A user invokes the Skill without an API key present in the process environment.
2. The Agent follows the documented instruction and runs `cat ~/.upkuajing/.env`.
3. The complete file contents are returned to the Agent or terminal.
4. The API key and any additional secrets in that file become part of visible or retained output.
5. A user, observer, log reader, or compromised Agent context obtains the disclosed credentials.
6. The exposed API key can be reused to make authenticated and potentially billable requests.

### Impact Assessment

Exploitation exposes secrets available in `~/.upkuajing/.env`; it does no
...[truncated 359 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the cat ~/.upkuajing/.env instruction.
  • Check only whether the required variable exists and is nonempty, without printing its value.
  • Prefer the existing get_api_key() implementation or a dedicated status-check command that returns only a Boolean result.
  • Never include complete or partially revealed API keys in Agent output, logs, exceptions, or command examples.
  • Advise users to keep unrelated credentials in separate files so compromise of one service configuration does not expose other services.
  • If diagnostic output is required, return a message such as UPKUAJING_API_KEY is configured rather than the value.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auth.py:71
Finding

API Key Stored Without Enforced Owner-Only File Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 71-74
Vulnerability Type: Insecure local storage of authentication credentials
Risk Level: High

Vulnerable Code

python
# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The newly issued API key is written to ~/.upkuajing/.env using ordinary file creation without explicitly enforcing owner-only permissions. The resulting mode depends on the process umask and any pre-existing file permissions.

On a system with a permissive umask, shared home directory, inherited access-control entries, or an existing broadly readable file, another local account may be able to read the bearer token. Authentication credentials should not depend solely on ambient process configuration for their confidentiality.

The containing directory is also created without an explicit restrictive mode. While typical system defaults may result in acceptable permissions, the code does not guarantee that outcome.

Attack Path

  1. A user runs python scripts/auth.py --new_key.
  2. The remote service returns a new API key.
  3. The script creates or rewrites ~/.upkuajing/.env under the current umask and inherited filesystem permissions.
  4. The resulting file is readable by another local user or process.
  5. The local attacker reads the API key from the file.
  6. The attacker sends the key as a bearer token to the UpKuaJing API and performs operations authorized for the victim's key.

Impact Assessment

The issue does not itself provide remote code execution or elevated operating-system privileges. It can grant another local principal the same UpKuaJing API privileges as the legitimate key holder. This may include access to account information, paid API invocation, consumption of account funds, and access to data returned by authorized endpoints.

Remediation
View remediation

Remediation Suggestions

  • Create ~/.upkuajing with owner-only permissions, such as mode 0700.
  • Create the credential file atomically with mode 0600, for example by using os.open() with O_CREAT | O_EXCL and an explicit mode.
  • If the file already exists, verify and repair its permissions before writing.
  • Write through a securely created temporary file in the same directory, flush and synchronize it, and atomically replace the destination.
  • Avoid following symlinks when opening the credential file, and verify that the destination is a regular file owned by the current user.
  • Document the expected ownership and permissions and warn the user if they cannot be enforced.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:71
Finding

New-Key Operation Destructively Overwrites the Shared Environment File

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 18-34 and 71-74
Vulnerability Type: Destructive configuration-file update
Risk Level: Medium

Vulnerable Code

python
# 检查是否已存在 .env 文件和 API key
env_file = UPKUAJING_ENV_FILE

if env_file.exists():
    # 读取现有的 .env 文件
    try:
        with open(env_file, 'r', encoding='utf-8') as f:
            content = f.read()
            # 检查是否已有 API key
            for line in content.splitlines():
                line = line.strip()
                if line.startswith(f'{API_KEY_ENV}='):
                    existing_key = line.split('=', 1)[1].strip()
                    if existing_key:
                        return {
                            "success": False,
                            "message": f"错误：{env_file} 中已存在API密钥（{existing_key[:10]}...）。\n如需重新申请，请先删除文件中的 {API_KEY_ENV} 后再运行此命令。",
                            "envFilePath": str(env_file)
                        }
    except IOError:
        pass
python
# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The script checks whether a nonempty UPKUAJING_API_KEY entry already exists. If the file exists but the target entry is absent or empty, execution continues and the file is opened in w mode.

Opening the file in this mode truncates all existing content before writing the new key. Consequently, unrelated variables, comments, formatting, or credentials in the shared file are deleted. Updating one configuration entry does not require replacement of every other entry and therefore exceeds the minimum write scope required by the operation.

The behavior is particularly risky because the documentation treats ~/.upkuajing/.env as a shared persistent configuration location.

Attack Path

  1. ~/.upkuajing/.env already contains unrelated configuration e ...[truncated 1101 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse the existing file and update only the UPKUAJING_API_KEY entry.
  • Preserve unrelated variables, comments, and formatting wherever practical.
  • Refuse to modify an unreadable existing file rather than silently continuing after IOError.
  • Create a backup before migration or replacement.
  • Write the updated content to a securely created temporary file and atomically replace the original.
  • Preserve or strengthen the original ownership and permissions during replacement.
  • Detect symlinks and reject files not owned by the current user.
  • Consider storing this Skill's key in a dedicated credential file rather than a shared general-purpose environment file.

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unbounded Dependency Version Allows Unreviewed Future Package Installation

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned third-party dependency and non-reproducible installation
Risk Level: Medium

Vulnerable Code

text
httpx>=0.23.0

The associated installation instruction in SKILL.md is:

bash
pip install -r requirements.txt

Technical Analysis

The requirement specifies only a minimum version. Package resolution may therefore select any later httpx release and a varying set of transitive dependencies. The installed code can differ over time from the version reviewed during this audit.

Python package installation may execute package build hooks or other installation-time code. If a future allowed release or one of its resolved dependencies is compromised, malicious code could execute with the privileges of the user running pip. Even absent compromise, incompatible updates may alter security-sensitive networking behavior.

No typosquatted dependency or known malicious package was identified in the reviewed project. The issue is the unrestricted and non-reproducible dependency policy.

Attack Path

  1. A user follows the setup instructions and runs pip install -r requirements.txt.
  2. The package index resolves the newest release satisfying httpx>=0.23.0, together with current transitive dependencies.
  3. A future package release or transitive dependency is compromised, malicious, or incompatible.
  4. Installation or import executes the affected package code in the user's environment.
  5. The compromised dependency gains the permissions of the installing or executing user and may access local data, environment variables, or network resources available to that process.

Impact Assessment

If the dependency chain is compromised, the impact is potentially arbitrary code execution with the privileges of the user installing or running the Skill. That scope can include access to `UPKUAJING_API_ ...[truncated 266 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin httpx to a reviewed exact version instead of using an open-ended lower bound.
  • Generate and commit a lock file that includes all transitive dependencies.
  • Require cryptographic hashes for downloaded distributions, such as through pip --require-hashes.
  • Review and update dependency pins through a controlled maintenance process.
  • Run vulnerability and provenance checks against each locked release.
  • Install dependencies inside an isolated virtual environment rather than the user's global Python environment.
  • Prefer trusted package indexes and disallow unexpected alternate indexes or dependency links.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (42)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill apparently performs remote version checks, local cache writes, metadata parsing, and upgrade notifications in addition to its stated search purpose. Undisclosed update-check and filesystem behaviors expand the attack surface and can create unnecessary outbound requests and local state changes in environments expecting a simple data lookup.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill apparently performs remote version checks, local cache writes, metadata parsing, and upgrade notifications in addition to its stated search purpose. Undisclosed update-check and filesystem behaviors expand the attack surface and can create unnecessary outbound requests and local state changes in environments expecting a simple data lookup.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill apparently performs remote version checks, local cache writes, metadata parsing, and upgrade notifications in addition to its stated search purpose. Undisclosed update-check and filesystem behaviors expand the attack surface and can create unnecessary outbound requests and local state changes in environments expecting a simple data lookup.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill apparently performs remote version checks, local cache writes, metadata parsing, and upgrade notifications in addition to its stated search purpose. Undisclosed update-check and filesystem behaviors expand the attack surface and can create unnecessary outbound requests and local state changes in environments expecting a simple data lookup.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill apparently performs remote version checks, local cache writes, metadata parsing, and upgrade notifications in addition to its stated search purpose. Undisclosed update-check and filesystem behaviors expand the attack surface and can create unnecessary outbound requests and local state changes in environments expecting a simple data lookup.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The skill instructs reading ~/.upkuajing/.env directly and even suggests using cat to display it, which risks exposing the full API key and any other secrets in that file. In an agent setting, encouraging raw secret-file access is especially dangerous because credentials may be surfaced to logs, the model context, or unauthorized users.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash
cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The workflow directs the agent to inspect a local secret file and potentially handle user-supplied API keys, then store them in ~/.upkuajing/.env. This creates unnecessary secret-handling risk, including accidental disclosure, insecure storage, or prompting users to transmit credentials through unsafe channels.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

Automatically saving newly created API keys to a local plaintext .env file expands credential exposure and persistence risk. An attacker or unrelated process with filesystem access could recover the key, and the skill's broad instructions normalize insecure secret management as part of routine operation.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements API key issuance, account balance queries, pricing lookup, and recharge/payment order creation, which do not align with the stated alumni-search purpose of the skill. This capability mismatch is dangerous because it expands the skill's privileges into billing and credential lifecycle operations, increasing the chance of unauthorized charges, hidden monetization flows, or user deception.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The script writes a newly issued API key into a local .env file in plaintext. Storing secrets unencrypted in a predictable filesystem location increases the risk of key disclosure through local compromise, backups, misconfigured permissions, or accidental inclusion in support bundles and tooling.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script can create recharge orders and return a payment URL even though the skill is presented as an alumni lookup/network expansion tool. In this context, introducing billable payment functionality is especially risky because it can trigger or facilitate unexpected charges unrelated to the user’s apparent task.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a skill for finding corporate alumni, tracing career history, and expanding professional networks. This file instead collects invocation error details and sends them to a platform error-reporting endpoint, which is operational telemetry behavior unrelated to alumni discovery or recruitment workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents capabilities to read environment variables, access local files, write credentials, and make network calls, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this weakens containment and increases the chance of unintended credential exposure or overbroad execution if the skill is invoked in ambiguous contexts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest claims corporate alumni/former-colleague discovery using company/personnel identifiers, while the body documents school alumni lookup using hid and sid. Security-relevant identity mismatches like this are dangerous because they can trigger the skill for the wrong class of requests and lead to inappropriate data handling or user deception.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad and overlap with generic recruiting, networking, and coworker-search requests, which raises the chance of accidental or overly broad activation. In combination with billing, credential handling, and external network access, ambiguous activation makes misuse more likely and more harmful.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document instructs agents to send request parameters, response payloads, and exception context to a centralized error-reporting API. Although it mentions automatic masking of sensitive fields, it does not define what is masked, require minimization, or warn that stack traces, request parameters, and response data may still contain personal, confidential, or regulated data. In a skill focused on personnel and alumni lookup, those fields are especially likely to contain employee identifiers and career-history data, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill provisions a new platform API key and stores it locally, but this behavior is not justified by the advertised alumni-search functionality. In context, hidden credential provisioning broadens attack surface and may bind the user to an external service without clear consent or understanding.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:61