支持海外公司人员教育背景查询，按人员 ID 从全球公司数据库获取含院校、学位、专业与绩点的教育经历。帮助招聘人员、HR团队与用人经理核验学历背景、评估候选人资质、做出明智招聘决策——适合候选人筛选、背景核验与人才评估。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:52 AM UTC
• Version: 1.0.4

Overview

The skill appears to be a real paid data-lookup integration, but it also handles local API keys, account/recharge actions, and hidden version-check persistence that users should review before installing.

Install only if you are comfortable with this skill using a UPKUAJING API key, storing a newly issued key in a plaintext ~/.upkuajing/.env file, making paid API calls after confirmation, creating recharge payment links, and sending confirmed error reports to the provider. Avoid putting secrets or sensitive customer data into error-report context, and review the automatic version-cache behavior if you require no silent home-directory writes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly uses sensitive capabilities including network access, reading environment-backed secrets, and writing local files, but does not declare permissions or clearly bound those capabilities. That weakens informed consent and sandbox/policy enforcement, making it easier for a user or host to underestimate what the skill can do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is personnel experience lookup, but the skill also instructs the agent to perform account lifecycle actions such as creating API keys, writing them to disk, checking account status, creating recharge orders, reporting telemetry, and version/cache writes. This expands the operational scope far beyond the declared business purpose, increasing the chance of unauthorized billing, credential handling, and data egress under the cover of a simple lookup tool.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements API key provisioning, account inspection, pricing lookup, and recharge/payment flows that are outside the stated skill purpose of querying employment history. This capability expansion increases the attack surface and can enable unintended account and billing actions if the skill is invoked in a broader automation context.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Creating recharge orders is a financial operation unrelated to the described personnel-profile use case. In an agent ecosystem, exposing billing actions under a data-enrichment skill can lead to unauthorized or accidental spending if the capability is triggered by prompts, tool chaining, or operator misunderstanding.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Account balance and pricing queries disclose operational and billing information that is not necessary for a people-experience lookup skill. While less severe than direct payment initiation, this still broadens scope and may leak sensitive commercial/account metadata to users or downstream systems that only expected profile-enrichment behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module performs unrelated network communication and local persistence for version checking, which expands the skill's behavior beyond its stated business purpose. Even if intended for maintenance, hidden outbound requests and filesystem writes create unnecessary privacy, compliance, and supply-chain risk, especially when triggered automatically during normal API usage.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code introduces self-update/version-check capability that is not directly required for querying employment history data. Such auxiliary remote-check functionality increases attack surface and can be abused if the configured API base URL is compromised, redirected, or insufficiently governed.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The module creates and maintains a cache file under the user's home directory for behavior unrelated to the core skill purpose. While the stored data is limited, undisclosed persistence can violate least-privilege expectations and may be problematic in controlled or ephemeral execution environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script forwards a caller-supplied params object, including fields such as requestPath, requestId, and especially context, to a remote error-report API without any visible minimization, redaction, or user-facing notice. If context contains prompts, identifiers, personal data, tokens, or business-sensitive request details, this creates a real data leakage risk through telemetry.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The version check transmits the skill name to a remote API without any user-facing disclosure in this module. Although the data item is not highly sensitive by itself, silent telemetry about installed skills or capabilities can reveal tool usage patterns and inventory information.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The module writes a cache file into the user's home directory without explicit notice, creating undisclosed local state. This is low severity but still a valid security and privacy concern because users and operators may not expect this artifact or its retention behavior.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs reading from a local secrets file and can automatically apply for a new API key and save it into ~/.upkuajing/.env. Accessing and modifying credential stores is highly sensitive because it can expose existing secrets, silently establish new billable credentials, and persist them for later reuse.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: This finding repeats the same credential-handling behavior in context with subsequent billing flows, increasing risk because secret-file access is coupled with actions that can trigger account and payment operations. Combining local credential persistence with networked account management creates a strong possibility of unintended account changes or monetized abuse.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 76% confidence
• Finding: The code writes a newly issued API key in plaintext to a .env file under the user's home directory. Plaintext local secret storage increases the chance of credential compromise through weak filesystem permissions, backups, accidental inclusion in archives, or other local processes reading the file.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is only lower-bounded (`httpx>=0.23.0`) and not pinned to an exact version or constrained range, which makes builds non-reproducible and can silently pull in newer releases with breaking changes or newly introduced supply-chain risk. In a skill that retrieves and processes external company/person data over the network, an unexpectedly changed HTTP client version could affect transport behavior, certificate handling, redirects, or proxy behavior in security-relevant ways.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196