支持海外公司个人教育经历查询，根据个人 ID 从全球公司数据库中获取教育经历，包括学校、学历、专业和 GPA信息。帮助招聘人员、人力资源团队和招聘经理验证教育背景、评估候选人资质，并做出更明智的招聘决策——适用于候选人筛选、背景验证和人才评估。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.4

Overview

This skill mainly does the advertised education lookup, but it also includes account, billing, credential storage, and automatic update-check behavior that users should review before installing.

Install only if you are comfortable with this skill using a paid UpKuajing API account, storing its API key in ~/.upkuajing/.env, creating recharge payment links when balance is insufficient, and sending confirmed error reports to the provider. Prefer manually managing the API key and review any recharge or error-report action before approving it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions while its documented behavior includes reading environment secrets, reading and writing files under the user's home directory, and making network calls. This creates a transparency and consent problem: an agent or user may authorize the skill under a false assumption of limited capability, even though it can access credentials and persist data locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated purpose is education-history lookup, but the skill also documents account lifecycle and billing operations: API key issuance, local credential storage, account info retrieval, recharge order creation, pricing lookups, exception reporting, and version checks. That mismatch broadens the trust boundary and can lead users to approve a data lookup skill that also performs sensitive account and financial actions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements API key issuance, account inspection, and recharge/payment flows, which do not match the advertised skill purpose of querying education background data. This kind of capability mismatch is dangerous because it can hide credential onboarding and billing behavior inside a seemingly unrelated skill, increasing the chance that users or reviewers grant trust they would not otherwise give.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module performs an outbound version-check request and writes persistent cache data under the user's home directory, which is unrelated to the stated people-profile/education lookup purpose of the skill. Even though the transmitted data is limited to the skill name and the behavior appears operational rather than overtly malicious, it creates undisclosed network egress and local state changes that can surprise users, leak metadata, and expand the attack surface if the remote endpoint or base URL is not tightly controlled.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: When API logging is enabled, the code writes full request parameters and full response bodies to local log files, which can include sensitive personal profile data and possibly operational metadata. In the context of a people-intelligence/B2B profiling skill, this materially increases privacy and data-retention risk because queried identities and returned education/history data may be stored without minimization, masking, or user notice.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends arbitrary error-report parameters, including a free-form 'context' field, to a remote endpoint without any sanitization, minimization, or explicit disclosure to the caller. In an agent environment, exception context can easily contain sensitive user data, identifiers, request contents, or internal paths, creating a data-exfiltration and privacy risk if errors are reported verbatim.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The version check posts the skill name to a remote API without any user-facing warning or consent flow. While the payload is small and not obviously sensitive, it still reveals installed-skill metadata and establishes hidden network behavior, which is a privacy and transparency issue and can become more serious if the endpoint is attacker-controlled or correlated with other identifiers.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs checking for and using a secret stored in ~/.upkuajing/.env, and if absent, obtaining a new API key and automatically saving it there. Accessing local secret files and persisting credentials expands the attack surface: a compromised or overprivileged skill could read, overwrite, or misuse long-lived credentials without sufficient isolation.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This section continues the same credential-handling pattern by directing the agent to inspect ~/.upkuajing/.env and potentially create and save a new API key automatically. In the context of a sales-enrichment skill handling personal-profile data, combining credential access with outbound API operations is particularly sensitive because it enables sustained access to both account resources and queried personal data.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 79% confidence
• Finding: The script writes a newly issued API key directly to a .env file without any visible permission hardening or secure secret-store use. If the file is created with permissive default permissions or in a shared environment, other local users or processes may read the credential and abuse the associated account.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only (httpx>=0.23.0), which allows installation of any newer version, including unreviewed major releases with breaking changes or newly introduced supply-chain risk. While this is not an immediate exploitable flaw by itself, it weakens build reproducibility and can cause the skill to consume vulnerable or incompatible versions in different environments.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196