Security audit

支持海外公司个人教育经历查询，根据个人 ID 从全球公司数据库中获取教育经历，包括学校、学历、专业和 GPA信息。帮助招聘人员、人力资源团队和招聘经理验证教育背景、评估候选人资质，并做出更明智的招聘决策——适用于候选人筛选、背景验证和人才评估。

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly supports the advertised education-history lookup, but it bundles sensitive credential, billing, telemetry, and hidden update-check behavior that users should review before installing.

Install only if you trust Upkuajing with the queried person/profile data and your API account. Do not print or paste the contents of ~/.upkuajing/.env into chat or logs, review file permissions after key creation, use a virtual environment for dependencies, and require explicit confirmation before any paid query, recharge-order creation, or diagnostic error report.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:79
Finding: API Key File Created Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:36
Finding: Documentation Encourages Printing the API Key to Standard Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependency Allows Unreviewed Future Versions
Content: View full analysis
=0.23.0 ``` The Skill directs users to install this open-ended requirement: ```markdown 2. **安装依赖**：`pip install -r requirements.txt` ``` ### Technical Analysis The lower-bound-only constraint allows `pip` to install any currently available or future `httpx` release satisfying the requirement. There is no lockfile, exact version pin, or package hash verification. As a result, the installed code may differ from the dependency version reviewed during the Skill audit. A compromised future distribution, package-index compromise, or incompatible release could alter runtime behavior or execute code with the installing user's privileges. No evidence was found that the current dependency is malicious; the finding concerns the absence of reproducible and integrity-verified dependency resolution. ### Attack Path 1. The user follows the documented `pip install -r requirements.txt` instruction. 2. The package resolver selects a newer release that was not part of the audited artifact. 3. If that distribution or its dependency chain has been compromised, malicious installation or runtime code executes in the user's Python environment. 4. The malicious component inherits the privileges of the user running `pip` or the Skill. 5. It may access data available to that process, including the API credential loaded during subsequent Skill execution. ### Impact Assessment A compromised dependency can execute with the privileges of the installing or executing user. Potential exposure includes local files accessible to that user, the `UPKUAJING_API_KEY`, API request parameters, and returned education data. If installation is performed in a privileged environment, the impact increases accordingl ...[truncated 75 chars]
Remediation: View remediation
\ --hash=sha256: ``` All transitive packages must also be pinned and hash-verified for `--require-hashes` to provide complete coverage. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the broader skill package performs update checks, parses local metadata, or writes version cache files while claiming to perform person-education lookups, that is another material description mismatch. Hidden update and local-state behaviors are risky because they add undeclared network egress and file-system modification channels unrelated to the user’s expected task.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the broader skill package performs update checks, parses local metadata, or writes version cache files while claiming to perform person-education lookups, that is another material description mismatch. Hidden update and local-state behaviors are risky because they add undeclared network egress and file-system modification channels unrelated to the user’s expected task.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the broader skill package performs update checks, parses local metadata, or writes version cache files while claiming to perform person-education lookups, that is another material description mismatch. Hidden update and local-state behaviors are risky because they add undeclared network egress and file-system modification channels unrelated to the user’s expected task.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the broader skill package performs update checks, parses local metadata, or writes version cache files while claiming to perform person-education lookups, that is another material description mismatch. Hidden update and local-state behaviors are risky because they add undeclared network egress and file-system modification channels unrelated to the user’s expected task.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill instructs reading ~/.upkuajing/.env directly and even shows cat ~/.upkuajing/.env, which exposes the location and retrieval method for secrets. In an agent setting, encouraging direct credential-file reads increases the risk of secret disclosure in logs, outputs, or downstream tool calls, especially since the skill’s main purpose does not require revealing the key contents to the user.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This section directs the agent to inspect a local secret file for UPKUAJING_API_KEY and, if absent, to initiate key application and save the new key into the same file. That combines secret discovery, account provisioning, and persistent secret storage inside a low-trust skill flow, increasing the chance of credential exposure, unauthorized account creation, or insecure storage practices.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
### **未设置API密钥** 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择；

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Automatically saving a newly issued API key to ~/.upkuajing/.env establishes persistent local credential handling without any documented safeguards such as file-permission checks, encryption, or redaction. In the context of a skill expected to perform education lookups, this is disproportionately dangerous because it expands the trust boundary from data retrieval into secret lifecycle management.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file implements API key issuance, account inspection, pricing, and recharge operations, while the skill metadata describes only personnel education/background lookup. This scope mismatch is dangerous because it introduces hidden financial and credential-management capabilities that users and reviewers would not reasonably expect from the advertised skill, increasing the risk of misuse or deceptive bundling.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The code writes the newly issued API key in plaintext to a .env file under the user's home directory. Plaintext secret storage increases the risk of credential disclosure through local compromise, backups, misconfigured permissions, or accidental inclusion in logs or support bundles.
Content: Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.
python
"envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.
python
API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script adds a remote error-reporting capability that is unrelated to the skill’s declared purpose of querying personnel education/background data, which increases the attack surface and creates an undisclosed telemetry channel. Because the reported payload includes fields like requestPath and context and is sent off-box via make_request, operational or user-derived data may be exfiltrated to the platform without necessity for the advertised function.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares capabilities that imply environment access, local file access, file writes, and network use, but it does not define any explicit tool scope or permission boundaries. In an agent environment, that creates overbroad authority and makes it easier for the skill to read credentials, modify local state, or invoke remote services beyond the narrowly expected education-query use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 文件从名称后缀“zh”到标题与说明内容均默认中文，但未说明这是面向中文用户的受限场景，也未给出用户可选择其他语言的机制。根据语言/地区政策，强制特定语言而无用户选择属于自然语言策略风险。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: L003 用自然语言概述了可“查询目标人员的履历与学术背景”“完善 B2B 销售客户画像”等用途，但没有给出明确触发短语、调用边界或不应触发的负例。对 markdown 技能说明而言，这种宽泛描述可能与常见用户请求重叠，增加误调用风险。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation embeds account management, API key issuance,充值 ordering, pricing lookup, and exception reporting into a skill framed as an education-history query tool. This expands the operational scope into credential handling and billing workflows, making accidental misuse or social engineering easier because sensitive actions are bundled with a routine data-retrieval task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly instructs callers to send raw request parameters, response data, and exception context to an error-reporting endpoint. Even if the platform says sensitive fields are automatically redacted, the skill handles personal profile and education data, so these payloads may still contain personal data, identifiers, or contextual secrets that are unnecessary for centralized error reporting. The absence of a clear minimization rule, user warning, or explicit field allowlist creates a real privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Recharge-order creation and balance-management capabilities exceed the minimum permissions and actions needed for an education/background lookup skill. In context, this expands the blast radius from data retrieval to billable account actions, enabling unexpected charges or abuse if the script is invoked by a user or higher-level agent without understanding these side effects.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/common.py:196

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Credential Access

API密钥与充值

Credential Access

Credential Access

Description-Behavior Mismatch

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Description-Behavior Mismatch

Undeclared Tool Scope

Natural-Language Policy Violations

Vague Triggers

Context-Inappropriate Capability

Missing User Warnings

Unsafe Defaults

Unsafe Defaults

Context-Inappropriate Capability

Static analysis

File appears to expose a hardcoded API secret or token.