Identify corporate alumni and former coworkers via company ID and personnel ID lookups across global business databases. Generate complete alumni rosters forany target enterprise.Recruiters, sales teams and B2B lead generation specialists map professional networks, track career trajectories and expand contactdatabases at scale. Streamline talent sourcing, candidate background research and corporate partnership relationship analysis workflows.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.5

Overview

This is a paid UpKuaJing alumni lookup skill, but it also stores API keys locally, exposes account/payment flows, and performs an undisclosed version-check network call, so users should review it carefully before installing.

Install only if you are comfortable giving the skill an UpKuaJing API key, allowing paid API calls after confirmation, and using its account/top-up helpers. Treat ~/.upkuajing/.env as a sensitive plaintext secret file, avoid sending raw personal or business data in error reports, and be aware the scripts silently check the skill version with the vendor once per day during API use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no explicit permissions while instructing the agent to access environment variables, read and write a local credential file, and make networked API and payment-related calls. This creates a transparency and consent gap: operators may authorize the skill based on an incomplete understanding of its capabilities, increasing the risk of unintended credential handling and external data disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior goes far beyond the stated alumni-search purpose: it includes API key provisioning, local secret persistence, account balance and pricing checks, top-up/payment flows, remote reporting, and a different query model than advertised. This mismatch undermines informed consent and can socially engineer users into authorizing credential, billing, and network actions they did not expect.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The manifest advertises corporate alumni/former-colleague search by company/person identifiers, but the implementation described is a school-based alumni lookup using hid and sid. This semantic mismatch can mislead users about what dataset is being queried and what personal relationship inferences are being made, increasing privacy and misuse risk in recruiting and lead-generation contexts.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The manifest claims career-history tracing, but the skill itself only exposes an alumni list query and depends on other skills for person and education lookup. Overstating capability can cause users to over-trust the skill, chain additional data sources unnecessarily, and expose more personal data than needed to satisfy the actual function.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements API key issuance, account lookup, pricing, and recharge/payment flows, which do not align with the advertised alumni-search/recruitment purpose of the skill. That mismatch increases supply-chain and deceptive-functionality risk because users may install a networking skill that silently brings in billing/account-management capabilities unrelated to its stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Account-balance access and recharge-order creation are not justified by the stated alumni-search use case, so they expand the skill's privilege and financial attack surface without a clear business need. In a mislabeled skill, this can facilitate unwanted account reconnaissance or push users into a payment flow they did not expect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This module adds outbound version-checking and persistent local cache writes that are unrelated to the stated alumni-search functionality. Even if framed as maintenance, it expands the skill's behavior beyond user expectations, creates an unnecessary data flow to a remote service, and introduces a covert update/telemetry mechanism that could be abused or violate least-privilege expectations.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code derives the installed skill name from the local filesystem and sends it to a remote API, which enables fingerprinting of the user's installed capability set. In a recruitment/alumni-search skill, this is not necessary to deliver core functionality, so it acts as unjustified telemetry and could expose organizational tooling usage to an external service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly instructs sending request parameters, response data, and exception context to an error-report endpoint, and only states that sensitive fields will be 'automatically masked' without defining scope, guarantees, or user-consent requirements. In a skill that handles company IDs, personnel IDs, career history, and recruitment/B2B data, these payloads can easily contain personal or confidential business information, creating a realistic risk of privacy leakage or over-collection in telemetry.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code creates a recharge order and returns a payment URL with no confirmation prompt, risk disclosure, or secondary approval step. This makes it easier to initiate a billable flow accidentally or through social engineering, especially in a skill whose expected purpose is unrelated to payments.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code forwards request metadata and a free-form `context` field to a remote endpoint via `make_request('/agent/skill/error/report', params)` with no visible minimization, redaction, consent, or sensitivity checks. In a skill focused on corporate alumni/personnel lookups, error context could easily contain personal data, company identifiers, request contents, or internal paths, creating a privacy and data-leak risk if exceptions are reported verbatim.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The version check posts skill metadata to a remote endpoint without any user-facing notice, consent, or runtime disclosure. Silent transmission of metadata is a security and privacy issue because users cannot evaluate or control when the skill contacts external infrastructure, and the alumni-search context does not justify background telemetry.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 97% confidence
• Finding: The skill instructs the agent to inspect and potentially populate a local ~/.upkuajing/.env file containing an API key, which is direct credential access and persistence. In an agent context, reading or writing local secret files expands the blast radius of compromise and can expose credentials to logs, other tools, or unauthorized follow-on actions.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 97% confidence
• Finding: The documented flow allows automatic saving of a newly created API key into ~/.upkuajing/.env, again coupling credential issuance with local file persistence. This is dangerous because it normalizes secret handling in plaintext local storage and may lead users to authorize credential operations they do not understand, especially in a skill already involving billing and external network calls.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: Writing a newly issued API key directly into a local .env file stores credentials in plaintext, increasing the risk of accidental disclosure through backups, logs, permissive filesystem permissions, or other tools that automatically ingest environment files. In a third-party skill with unrelated billing/account logic, plaintext secret storage is more concerning because users may not expect local credential persistence.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is only lower-bounded (httpx>=0.23.0), which makes builds non-reproducible and allows installation of any future version, including releases with breaking changes or newly introduced vulnerabilities. In a skill that likely performs network-based lookups, dependency drift in an HTTP client increases supply-chain and reliability risk, though this file alone does not indicate active exploitation.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:61