支持海外公司人员教育背景查询，按人员 ID 从全球公司数据库获取含院校、学位、专业与绩点的教育经历。帮助招聘人员、HR团队与用人经理核验学历背景、评估候选人资质、做出明智招聘决策——适合候选人筛选、背景核验与人才评估。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.4

Overview

This skill appears to support the advertised paid business-person lookup, but it needs review because it handles API keys unsafely and includes account, billing, and recharge actions beyond a simple lookup.

Review this skill before installing. Use it only if you trust the Upkuajing service and are comfortable with paid API calls, account lookups, and recharge-order creation. Do not run the documented cat command on the .env file or paste API keys into chat; prefer a protected environment variable or secret store and restrict ~/.upkuajing permissions. Confirm every paid query, recharge, new-key, and error-report action explicitly, and avoid sending raw personal data in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

API Key Exposure Through Terminal and Agent Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:61

Finding

API Key File Is Created Without Explicit Owner-Only Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:18

Finding

New-Key Operation Can Destructively Truncate Existing Configuration

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Reduces Supply-Chain Reproducibility

Content

View full analysis

=0.23.0 ``` The installation instructions execute dependency resolution directly: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirement accepts every future `httpx` release at or above version 0.23.0. It does not define an upper bound, exact reviewed version, lock file, or package hash. Consequently, two installations at different times can resolve to materially different code. This is not evidence that the current `httpx` package is malicious. The risk is that future compromised, incompatible, or behavior-changing releases are automatically eligible without a corresponding Skill review. The absence of hashes also prevents pip from verifying that the selected artifact is the exact artifact reviewed by the project. ### Attack Path 1. A user follows the documented installation command. 2. Pip resolves the newest package version satisfying `httpx>=0.23.0`. 3. A future compromised or incompatible release is eligible for selection. 4. Pip downloads and installs that release. 5. The unreviewed dependency executes during import or affects outbound request and credential-handling behavior at runtime. ### Impact Assessment A compromised dependency executes with the privileges of the user running the Skill. It could potentially access the Skill’s process environment, API key, files available to that user, and network connectivity. The finding identifies supply-chain exposure rather than a confirmed compromise of the currently available dependency. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a targeted personnel-history lookup, but it also describes local credential access, generic outbound API usage, local task/result handling, and possible request/response logging. Those side capabilities expand the data exposure surface beyond the stated business purpose and can lead to credential leakage or collection of unrelated sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The skill is presented as a targeted personnel-history lookup, but it also describes local credential access, generic outbound API usage, local task/result handling, and possible request/response logging. Those side capabilities expand the data exposure surface beyond the stated business purpose and can lead to credential leakage or collection of unrelated sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a targeted personnel-history lookup, but it also describes local credential access, generic outbound API usage, local task/result handling, and possible request/response logging. Those side capabilities expand the data exposure surface beyond the stated business purpose and can lead to credential leakage or collection of unrelated sensitive artifacts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a targeted personnel-history lookup, but it also describes local credential access, generic outbound API usage, local task/result handling, and possible request/response logging. Those side capabilities expand the data exposure surface beyond the stated business purpose and can lead to credential leakage or collection of unrelated sensitive artifacts.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Referencing the local .env file as the place to obtain the API key is a concrete credential-access pattern. In this context, the danger is elevated because the skill text operationalizes secret retrieval for the agent, increasing the chance that credentials are exfiltrated, echoed back to users, or exposed in logs.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill instructs checking for the API key in ~/.upkuajing/.env and supports writing a newly obtained key back into that file. That combines credential discovery with local secret persistence, expanding the risk of exposure, unauthorized modification, and accidental leakage through future file reads or backups.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This section explicitly authorizes applying for a new API key and auto-saving it into a plaintext local .env file. In a skill whose stated purpose is person-history lookup, that is unnecessarily sensitive functionality and increases the blast radius from simple data access to credential issuance and storage compromise.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script implements API key issuance, account inspection, recharge-order creation, and pricing lookup, which materially exceeds the declared skill purpose of retrieving personnel experience data. In an agent-skill context, hidden billing and credential-management capabilities expand the attack surface and can be abused to provision access or incur charges unrelated to the advertised function.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The function explicitly checks for and manages an API key in a .env file, indicating local credential handling inside the skill. In agent environments, local file-based secret storage increases exposure to accidental disclosure, weak file permissions, and downstream leakage through logs, backups, or tool chaining.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The code reads the entire .env file to inspect existing credentials, which confirms direct access to locally stored secrets. Handling secrets as plain text broadens the blast radius if the host is shared, compromised, or if subsequent code accidentally exposes the file content.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The script writes the issued API key directly to a .env file in plaintext. Plaintext persistence of newly created credentials is dangerous because other local users, processes, backups, or accidental repository inclusion can expose the secret and enable unauthorized API use.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Recharge-order creation and pricing-query functionality are not necessary to fulfill the stated business purpose of building contact employment timelines. In a hosted or agent-executed environment, such monetization features can be triggered unexpectedly, causing financial loss or facilitating unauthorized service consumption.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill declares capabilities that imply environment access, local file read/write, and network use, but it does not declare any explicit tool scope or allowed-tools boundary. That weakens least-privilege controls and makes it harder for a host agent to constrain credential access, local file modification, and outbound requests to only what is necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill name includes a 'zh' locale marker and the description and operating instructions are entirely in Chinese, but the file does not offer any user language choice or explain that the skill is intentionally region- or language-specific. This can violate language/locale policy because it effectively forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly tell the operator to read a local .env file containing the API key and even provide the command and path. In an agent setting, that creates a direct credential-exposure path: the model may retrieve and surface secrets from local storage when only a service invocation was intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill includes account-management and monetization operations such as new API key application, account info lookup, and recharge order creation, which are not necessary for simply querying a person's employment history. In context, that makes the skill more dangerous because a user seeking lookup functionality could unintentionally trigger billing or credential lifecycle actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The API documentation explicitly allows reporting raw request parameters, response data, and exception context, and only mentions automatic masking without requiring callers to minimize or manually review sensitive content before submission. In this skill context, the data may include personal employment-history information and agent-side request/response payloads, so error reports can become a secondary channel for leaking personal, confidential, or regulated data into centralized logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code’s user-facing natural-language descriptions and messages are written exclusively in Chinese, and there is no indication that users can opt into another language. Under the policy for natural-language constraints, forcing a specific language without user choice is a violation unless the locale limitation is clearly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code can request a new API key and persist it locally, which is a privileged credential-management capability beyond the core data-retrieval task. Even if intended for convenience, embedding credential provisioning in the skill increases the chance of unauthorized account creation, secret sprawl, and misuse in automated environments.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196