支持海外公司同事查询 / 同事团队挖掘，按公司 ID + 人员 ID从全球企业数据库一键找出其公司同事。帮助招聘人员、销售团队、B2B线索构建者、批量寻找潜在联系人——适合关系网拓展、人才背调调研、客户内部决策圈摸排，常用于找到关键人后挖出更多对接人与决策人。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:30 AM UTC
• Version: 1.0.5

Overview

This skill mostly matches a paid colleague-lookup integration, but it also has under-disclosed credential persistence and automatic network/version-check side effects that users should review first.

Install only if you are comfortable with this skill using a paid Upkuajing API, storing an API key in a plaintext file under ~/.upkuajing, creating recharge orders when guided, and making automatic version-check requests. Review API costs before confirming queries, protect or rotate the API key as needed, and avoid sending sensitive request/response details in error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill exposes capabilities to read environment-backed secrets, access local files, write files, and perform network actions, yet it declares no permissions or equivalent user-visible capability boundaries. That creates a transparency and consent problem: an operator may invoke a simple 'colleague lookup' skill without realizing it can inspect ~/.upkuajing/.env, create or modify local state, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior substantially exceeds the stated purpose of colleague lookup by including API key issuance, local credential storage, account-info retrieval, billing/recharge flows, pricing lookup, exception reporting, and version caching. This mismatch is dangerous because users may grant trust based on the narrow description while the skill performs financially sensitive and credential-handling operations outside that scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill includes account registration, API key issuance, recharge order creation, and account/account-balance operations that are not necessary for basic colleague search. These capabilities increase the attack surface and can lead to unintended credential creation, billing actions, or account manipulation under the guise of a data lookup task.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The exception-reporting feature sends request metadata back to the platform, which is outside the core colleague-search purpose and may disclose identifiers, request IDs, or contextual data to a third party. While framed as troubleshooting, it still creates a data-exfiltration path that users may not expect from a lookup skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script writes a newly issued API key into a local .env file in the user's home directory without any explicit permission hardening or secret-store integration. Storing long-lived credentials in plaintext increases the chance of credential disclosure through local compromise, backups, misconfigured file permissions, or accidental inclusion in logs and tooling.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This module performs outbound network communication to a server-controlled endpoint and writes persistent state under the user's home directory, even though the skill's stated purpose is colleague/network discovery. That creates hidden side effects and a telemetry/update channel that could expose skill usage metadata, enable unexpected connections, and broaden the attack surface if the endpoint or configuration is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code contains a self-update/version telemetry capability unrelated to the skill's advertised business-network lookup function. Even though it only submits the skill name, it still creates an undisclosed signaling path to a remote service and can be repurposed for tracking, remote influence, or operational dependency outside the expected feature set.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly recommends sending request parameters, response payloads, and error context to an external error-reporting API, while only vaguely stating that sensitive fields will be auto-masked. In a skill that processes business-networking and company/person data, these fields can still contain personal, proprietary, or confidential information, so insufficient disclosure and minimization creates a real privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The request/response logging functions persist full transmitted data, including request parameters and entire API responses, to local log files. Because this skill handles people/company relationship data and may also include authenticated queries, these logs can capture sensitive business or personal data without sanitization, consent, retention limits, or permission hardening.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code forwards a caller-controlled 'context' plus request metadata to a remote endpoint without any redaction, minimization, or user-visible disclosure in this file. If 'context' contains stack traces, tokens, personal data, or business-sensitive request contents, the error-report path can leak sensitive information to the platform unnecessarily.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs reading ~/.upkuajing/.env to check for an API key, which is direct access to local credential material. Any skill that reads secret stores for a nominal lookup task materially increases the risk of credential exposure, misuse, or overcollection, especially if permissions are not clearly disclosed.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 98% confidence
• Finding: The skill goes beyond reading credentials and can automatically obtain a new API key and save it into ~/.upkuajing/.env. This is dangerous because it combines credential provisioning with local persistence in a hidden state file, enabling silent account binding or secret modification in a skill whose advertised purpose is only colleague lookup.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 90% confidence
• Finding: The code is explicitly designed to manage credentials via a .env file, which signals plaintext secret storage and handling. Even at the point where the file path is selected and existence is checked, the surrounding design choice is risky because it normalizes storing API secrets in a locally readable file rather than in a protected secret store.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 88% confidence
• Finding: Reading an existing .env file to recover API key material means the script processes plaintext credentials directly from disk. This increases exposure if the environment file is accessible to other local users, synced to cloud storage, or mishandled by surrounding tooling.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 95% confidence
• Finding: The script writes the API key directly into a .env file as plaintext, creating a durable local credential artifact. This is dangerous because API keys can be exfiltrated by malware, other local users, accidental backups, or repository/tooling mistakes, enabling unauthorized API use and account abuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency specification uses a lower-bound-only constraint (`httpx>=0.23.0`), which allows automatic installation of any newer release, including future major versions with breaking changes or newly introduced vulnerabilities. This creates supply-chain and reproducibility risk because builds are not deterministic and security review of one version does not guarantee safety of later resolved versions.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196