Fetch personal academic records from global databases via individual ID lookup queries. Extract complete educational profiles covering attended institutions,awarded degrees, majors and GPA metrics.Recruiters, HR teams and hiring managers validate applicant education histories, assess candidate credentials anddeliver data-backed hiring judgements. Streamline pre-employment screening, formal background verification and end-to-end talent assessment workflows forcorporate recruitment teams.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 1.0.4

Overview

The skill is a real paid API client for education-history lookup, but it handles credentials and account/payment flows too broadly for a hiring background-check tool.

Review this before installing in an HR or enterprise environment. Do not let the agent print ~/.upkuajing/.env, prefer injecting UPKUAJING_API_KEY through a secure secret mechanism, restrict file permissions if a local key file is used, and require explicit human approval for any paid query, top-up order, or error report that may include candidate data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Documentation Instructs the Agent to Print a Complete Credential File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:72

Finding

API Key File Is Written Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependency Installation

Content

View full analysis

=0.23.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency declaration specifies only a lower bound. It permits pip to install any current or future `httpx` version selected by the configured package index and resolver. No lock file, exact version, artifact hash, or index restriction is provided. This makes installations non-reproducible and expands the trusted supply-chain surface. A future compromised release, compromised package-index account, malicious index configured in the environment, or incompatible release could alter the Skill's network behavior or execute package-controlled code during installation or runtime. The package name is not an apparent typo, and no malicious package is included in the repository. The risk arises from unconstrained and unverified resolution rather than evidence that the current `httpx` package is malicious. ### Attack Path 1. A user follows `SKILL.md` and runs `pip install -r requirements.txt`. 2. Pip resolves `httpx` and transitive dependencies from the configured package source. 3. The resolver selects an unreviewed future release or an artifact supplied by a compromised or attacker-controlled index. 4. Malicious installation or runtime code executes with the privileges of the user running pip. 5. That code may access the Skill's environment, including the API key, modify local files available to the user, or alter outbound API traffic. Successful exploitation depends on compromise or manipulation of the dependency source or a subsequently released malicious artifact. ### Impact Assessment Malicious dependency code would execute with the privileges of the account installing or running the Skill. It could read user-accessible files and e ...[truncated 254 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates software/version update checking and cache writes that are unrelated to the stated education-verification function. Even if operationally useful, undocumented update checks introduce additional outbound network traffic and local state changes outside the user’s expected task flow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding indicates software/version update checking and cache writes that are unrelated to the stated education-verification function. Even if operationally useful, undocumented update checks introduce additional outbound network traffic and local state changes outside the user’s expected task flow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates software/version update checking and cache writes that are unrelated to the stated education-verification function. Even if operationally useful, undocumented update checks introduce additional outbound network traffic and local state changes outside the user’s expected task flow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates software/version update checking and cache writes that are unrelated to the stated education-verification function. Even if operationally useful, undocumented update checks introduce additional outbound network traffic and local state changes outside the user’s expected task flow.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading the API key from ~/.upkuajing/.env and even demonstrates accessing the file contents directly. Direct credential file access is dangerous because it can expose secrets to the agent, logs, or downstream tooling beyond what is necessary for making the API call.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The workflow tells the agent to check for the API key in a local .env file and, if absent, create a new key that is automatically saved there. This is dangerous because it combines credential discovery, credential provisioning, and local secret persistence in a user-task skill, increasing the risk of unauthorized secret handling and long-lived exposure on disk.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The instruction to inspect ~/.upkuajing/.env for UPKUAJING_API_KEY encourages local secret enumeration as part of normal execution. In this HR context, that is more dangerous because the skill already processes sensitive personal data, so combining credential access with personal-data queries creates a stronger privacy and misuse risk.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements API key issuance, account lookup, pricing, and recharge/payment flows that are unrelated to the stated education-verification purpose of the skill. In a skill intended for HR background checks, adding billing and platform-auth management expands the attack surface and suggests hidden external service dependency or undisclosed monetized operations, which is dangerous because users may invoke capabilities they did not intend to trust.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 69% confidence

Finding

The code reads the entire .env file and parses out an API key, then later includes part of the existing key in a user-facing message. Storing and handling credentials in plaintext .env files increases exposure risk on multi-user systems, in backups, or if file permissions are weak; partial disclosure also leaks identifying secret material that can aid attackers.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code writes a newly issued API key directly to a plaintext .env file under the user's home directory. Plaintext credential storage is dangerous because local compromise, permissive file permissions, backups, logs, or developer tooling can disclose the key, enabling unauthorized API access and abuse of the linked account.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises code-capable behavior that includes environment access, file reads/writes, and network use, but it does not declare an explicit tool scope or permissions boundary. That creates an authorization ambiguity where a reviewer or runtime may not clearly constrain what the skill is allowed to touch, increasing the risk of unintended credential, filesystem, or network access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest frames the skill as HR-focused verification for hiring, but the actual behavior is a generic person-education lookup for any person ID in a broad people database. In context, that makes the skill more dangerous because it normalizes access to potentially sensitive personal education data under a narrower, legitimacy-enhancing HR framing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill includes account-management and paid transaction capabilities, such as key creation and top-up workflows, that are not justified by the stated education-verification purpose. This increases the blast radius from simple data retrieval to account provisioning and financial actions, which can be abused or triggered unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs callers to send request parameters, response data, and exception context to a centralized error-reporting API, which can easily include candidate PII, education records, tokens, stack traces, and other sensitive operational data. Although it claims sensitive fields are automatically redacted, it does not define the redaction scope or require user/operator warning, minimization, or explicit exclusion of regulated personal data, creating a real privacy and data-leak risk in an HR background-check context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains natural-language strings that define the skill description and CLI help/output entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using require_auth=False for credential provisioning is an unsafe default because it creates a privileged resource without prior trust establishment. Even if the backend intends to allow self-service signup, embedding this behavior in a seemingly unrelated HR verification skill increases the likelihood of silent third-party service enrollment and misuse.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Using require_auth=False for credential provisioning is an unsafe default because it creates a privileged resource without prior trust establishment. Even if the backend intends to allow self-service signup, embedding this behavior in a seemingly unrelated HR verification skill increases the likelihood of silent third-party service enrollment and misuse.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Recharge-order creation and account-balance retrieval are not justified by the advertised function of verifying candidate education records. Exposing payment-related functions inside a hiring verification skill can lead to unauthorized purchases, social-engineering opportunities, and misuse of enterprise funds if the skill is triggered in automated or delegated workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains natural-language descriptions and later user-visible error/output strings exclusively in Chinese, starting with the module docstring. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.