Fetch personal academic records from global databases via individual ID lookup queries. Extract complete educational profiles covering attended institutions,awarded degrees, majors and GPA metrics.Recruiters, HR teams and hiring managers validate applicant education histories, assess candidate credentials anddeliver data-backed hiring judgements. Streamline pre-employment screening, formal background verification and end-to-end talent assessment workflows forcorporate recruitment teams.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:52 AM UTC
• Version: 1.0.4

Overview

This skill appears to be a legitimate paid education-verification integration, but it bundles sensitive HR lookups with credential storage, billing actions, and remote error reporting that need review before use.

Install only if you trust UpKuaJing with candidate education data and account metadata, and make sure operators understand that queries incur fees. Use a dedicated API key with limited exposure, protect ~/.upkuajing/.env, avoid enabling full request/response logging in sensitive HR environments, and do not send candidate records or account secrets in error reports unless your policy permits it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes capabilities to read environment/config files, write credentials, and make networked API/payment calls, but does not declare permissions or narrowly scope them. This creates an integrity and transparency problem: operators and users cannot accurately assess what the skill can access or modify before it runs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The advertised purpose is education verification for hiring, but the documented behavior also includes account creation, balance checks, top-up order generation, pricing retrieval, and error reporting to a third-party platform. This mismatch is dangerous because it can cause users or orchestrators to authorize a narrowly described HR-check skill that actually performs broader account-management and paid external operations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements authentication, API key issuance, account balance lookup, pricing, and recharge-order creation, which are administrative and billing functions unrelated to the stated purpose of verifying overseas education history. This scope mismatch increases supply-chain risk because a hiring/background-check skill can unexpectedly manipulate platform credentials and payment workflows.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code exposes a function to create recharge/payment orders, which is unrelated to candidate education verification and can trigger financial operations from within an HR-oriented skill. Embedding payment capabilities in a mismatched skill raises the risk of unauthorized charges, abuse, or deceptive behavior under a trusted business workflow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill can provision a new API key and persist it locally, which is an administrative credential-management capability outside the documented HR verification purpose. Even if intended for setup convenience, hidden credential issuance in a domain-specific skill broadens attack surface and may enable unauthorized use of the platform API.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Retrieving account balances and API pricing is administrative/account-management functionality not justified by the skill's stated education-verification role. This unnecessary privilege exposure can leak business-sensitive account information and normalize off-purpose operations within a trusted HR workflow.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module performs outbound network access and persistent local caching that are unrelated to the skill’s stated purpose of education verification. While likely intended for update notification, the behavior expands the skill’s trust boundary, creates an undeclared telemetry path, and adds filesystem persistence that could surprise users or violate least-privilege expectations in sensitive HR workflows.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The self-update check is functionality unrelated to candidate education verification and introduces an unnecessary external dependency during skill execution. In an HR background-check context, unexpected outbound calls can create compliance, privacy, and supply-chain risk even if only the skill name is sent.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger phrases are broad and hiring-oriented, which increases the chance the skill is invoked in contexts beyond narrow education verification. In an HR setting, overbroad invocation can expose sensitive personal data or trigger paid lookups on individuals without sufficiently specific user intent or eligibility checks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly instructs agents to send request parameters, response payloads, and error context to an error-reporting endpoint. Even though it states sensitive fields are 'automatically desensitized,' it provides no concrete guarantees, user notice, consent flow, data-minimization rules, or restriction against including candidate education records and other personal data in logs. In an HR/background-check skill handling overseas candidate information, this creates a real privacy and compliance risk because error reports can become a secondary channel for transmitting personal or sensitive data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The logging helpers can write full request parameters and response bodies to local log files, which may include candidate education records, GPA data, and possibly other sensitive personal data. Although logging is disabled by default, enabling it creates a quiet local data retention path without redaction, consent handling, or access-control safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends a caller-supplied `context` field to a remote `/agent/skill/error/report` endpoint without any visible sanitization, redaction, or disclosure. In an HR education-screening context, exception context may contain candidate PII, education records, request metadata, or internal paths, creating a real risk of unnecessary sensitive-data exfiltration to platform telemetry.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code sends the skill name to a remote API without any user-facing notice or consent in this path. Although the transmitted field is limited, undisclosed outbound metadata transmission is still a privacy and transparency issue, especially in enterprise HR environments where software behavior may be audited.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 91% confidence
• Finding: The skill instructs checking and using a credential stored in ~/.upkuajing/.env and supports automatically applying for and saving a new API key there. Accessing local secret files and writing credentials to disk expands the blast radius of compromise and may expose sensitive tokens to other tools, logs, or users on the system.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 90% confidence
• Finding: This section continues the credential-handling flow by directing the agent to inspect ~/.upkuajing/.env and potentially persist a newly created API key automatically. In combination with networked account actions, that behavior creates a clear secret-management weakness and increases the risk of credential leakage or unauthorized reuse.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 90% confidence
• Finding: The code reads an existing .env file and processes API key material in plaintext, which is sensitive credential handling. In the context of an HR verification skill, local plaintext secret access is unnecessary to the stated business purpose and increases the chance of disclosure via weak file permissions, backups, or debugging.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 96% confidence
• Finding: The code writes a newly issued API key to a .env file in plaintext, creating a durable local secret that may be exposed through filesystem access, backups, or accidental inclusion in logs or archives. Because this skill's stated purpose is HR education verification, embedding secret persistence is especially risky and out of scope.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 96% confidence
• Finding: The dependency is specified with only a lower bound (httpx>=0.23.0), which allows future major or minor releases to be installed without review. This creates supply-chain and reliability risk because a compromised, incompatible, or vulnerable upstream release could be pulled into the skill at install time, making builds non-reproducible and harder to audit.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: Setting require_auth=False for the key-creation request establishes an unsafe default for a sensitive operation. In a skill that should only verify education credentials, this unexpected unauthenticated administrative behavior increases the chance of unauthorized account creation, automated abuse, or credential farming.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 88% confidence
• Finding: Setting require_auth=False for the key-creation request establishes an unsafe default for a sensitive operation. In a skill that should only verify education credentials, this unexpected unauthenticated administrative behavior increases the chance of unauthorized account creation, automated abuse, or credential farming.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58