ClawHub
Back to skill

Security audit

支持海外公司同事查询 / 同事团队挖掘，按公司 ID + 人员 ID从全球企业数据库一键找出其公司同事。帮助招聘人员、销售团队、B2B线索构建者、批量寻找潜在联系人——适合关系网拓展、人才背调调研、客户内部决策圈摸排，常用于找到关键人后挖出更多对接人与决策人。

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs the stated colleague lookup, but it also handles API keys and billing-related account actions in ways users should review carefully before installing.

Review before installing. Use this only if you trust the Upkuajing service, understand that lookups can incur fees, and are comfortable with local plaintext API-key storage. Avoid printing the `.env` file, prefer an environment variable or secret manager, verify any recharge or payment URL before acting, and avoid sending raw request or response data in error reports.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

API Key Exposed Through Unsafe Display Guidance and Insufficient File Permission Enforcement

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unbounded and Unverified Third-Party Dependency Installation

Content
View full analysis
=0.23.0 ``` `SKILL.md:19`: ```markdown 2. **安装依赖**：`pip install -r requirements.txt` ``` ### Technical Analysis The dependency specification permits any current or future version of `httpx` starting with version 0.23.0. It does not define an upper bound, pin an audited version, or provide package hashes. Consequently, separate installations of the same Skill may resolve to materially different dependency versions. A compromised upstream release, maliciously altered distribution artifact, or future incompatible version satisfying this broad constraint could be installed without any project-level integrity verification. This is not evidence that the legitimate `httpx` package is currently malicious. The vulnerability is the absence of reproducible version and artifact verification at the documented dependency installation boundary. ### Attack Path 1. An attacker compromises an eligible upstream package release or its distribution channel, or causes a malicious artifact to be served for a version satisfying `httpx>=0.23.0`. 2. A user follows the documented command: `pip install -r requirements.txt`. 3. The package resolver selects the compromised eligible version because no exact version or trusted hash is required. 4. Malicious installation or runtime code executes with the privileges of the user performing the installation or running the Skill. 5. That code can access resources available to the process, including the Skill's API key, files readable by the user, and network connectivity. ### Impact Assessment A successful supply-chain compromise could execute arbitrary Python code with the installing or runtime user's privileges. This could expose `UPKUAJING_API_KEY`, modify user-accessi ...[truncated 348 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes remote version checks, local cache writes, and parsing of local metadata that are not part of the stated colleague lookup function. Hidden auxiliary behavior broadens attack surface and creates additional network and filesystem side effects that a user would not reasonably expect from a simple lookup skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes remote version checks, local cache writes, and parsing of local metadata that are not part of the stated colleague lookup function. Hidden auxiliary behavior broadens attack surface and creates additional network and filesystem side effects that a user would not reasonably expect from a simple lookup skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill includes remote version checks, local cache writes, and parsing of local metadata that are not part of the stated colleague lookup function. Hidden auxiliary behavior broadens attack surface and creates additional network and filesystem side effects that a user would not reasonably expect from a simple lookup skill.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill explicitly instructs reading the local file containing the API key from ~/.upkuajing/.env. In context, this is credential access to a secret store, and exposing or unnecessarily reading raw secret files can lead to leakage, reuse of credentials, and compromise of the linked account.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill instructs checking for the API key in ~/.upkuajing/.env and, if absent, obtaining a new key and saving it automatically to the same local secret file. This combines credential discovery, issuance, and persistent storage in one workflow, increasing the risk of unauthorized credential creation or unsafe secret handling on the host.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill continues the same secret-handling pattern by directing the agent to interact with and write to ~/.upkuajing/.env for API key storage. In a low-trust skill context, instructions to access and persist credentials locally are especially dangerous because they normalize secret exposure and expand the blast radius if the agent or host is compromised.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file implements API key provisioning, account inspection, and payment-order creation, which materially exceeds the declared skill purpose of colleague/internal-team lookup. This capability mismatch is dangerous because users or orchestrators may grant trust based on the published description while the skill also performs account-management operations against an external service.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The script manages API credentials via a local .env file and later writes secrets there, which creates credential exposure risk if the file permissions are weak, the path is user-accessible, or the file is accidentally logged/committed. In this skill context, the code is directly provisioning a live API key, so mishandling storage can immediately enable unauthorized API use and account abuse.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

Reading an existing .env file to inspect stored API keys is part of credential handling and expands the secret exposure surface, especially because parsing is done in plaintext. Any compromise of the local environment or accidental inclusion of the file can reveal the active key and enable unauthorized requests.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The code writes the newly issued API key directly to a .env file in plaintext, creating a durable credential that may be exposed through backup systems, misconfigured permissions, or accidental source-control inclusion. Because this key grants access to the external platform account, compromise can lead to unauthorized consumption, billing, and data access under the victim account.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares capabilities that involve environment access, local file reads/writes, and network use, but it does not define any explicit tool scope or permissions boundary. That increases the chance an agent may exercise broader-than-expected powers, including reading secrets or writing files, without clear user-facing constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation directs the agent to handle account registration, API key issuance, recharge-order creation, and payment flow for a skill whose stated purpose is colleague lookup. In context, these features materially expand the operational scope into credential lifecycle and financial actions, increasing the chance of unauthorized or socially engineered account operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The API reference explicitly encourages sending raw request parameters, response data, and exception context for error reporting, while only stating that sensitive fields will be 'automatically masked' and giving no concrete guidance on what must never be uploaded. In practice, stack traces, request payloads, and response bodies often contain personal data, credentials, internal identifiers, or proprietary business information, so this can lead to unintended data disclosure to the platform-side logging system.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The top-level docstring states the script is for authentication management, API key issuance, and recharge, which conflicts with the advertised networking/research purpose of the skill. This discrepancy is a supply-chain trust problem because reviewers and users may underestimate what the skill can do based on the external description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language text exclusively in Chinese in the module docstring and CLI/help output, which effectively imposes a specific language on users. The policy allows locale constraints only when the skill offers opt-in choice or clearly documents a justified region-specific limitation, neither of which is present here.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python
pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Creating recharge orders and exposing account balance/pricing are monetization and account-management features unrelated to the narrow user-facing claim of enterprise colleague lookup. In a skill ecosystem, undisclosed billing capabilities increase the risk of deceptive behavior, unexpected charges, or misuse of trusted execution context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language instructions and documentation such as the module docstring and operational comments exclusively in Chinese. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

该技能的对外目的描述是查找企业内同事与团队成员，并未说明会访问宿主环境中的环境变量或用户主目录下的 ~/.upkuajing/.env 凭据文件。虽然访问远程企业资料库需要认证本身是合理实现细节，但从开发者意图审计角度看，主动读取宿主凭据存储属于额外敏感能力，描述中没有体现。

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196