Run personnel ID searches across global corporate databases to pull employees’ complete academic backgrounds. Retrieve full education credentials includingattended institutions, awarded degrees, majors and official GPA records. Recruiters, HR teams and hiring managers verify applicants’ education history andassess candidate qualifications to make data-driven hiring decisions. Streamline pre-hire screening, official background verification and end-to-endcomprehensive talent assessment.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:36 AM UTC
• Version: 1.0.4

Overview

This skill needs Review because it advertises education verification but actually retrieves work-history records and also includes credential, billing, and reporting flows.

Install only after confirming whether you intend to query work history, not education history. Treat the returned employment records as sensitive personal data, confirm each fee-incurring call, avoid sending raw personnel details in error reports, and protect or rotate any API key stored in ~/.upkuajing/.env.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill uses sensitive capabilities including environment-variable access, reading and writing local files, and network calls, yet it declares no permissions or equivalent capability boundaries. That creates a transparency and least-privilege failure: an invoking agent or user could reasonably expect a narrow education-check skill, while the skill can access credentials, persist data, and contact remote services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The manifest says the skill verifies education history, but the body documents materially different behavior including work-experience lookups, API-key lifecycle operations, account/balance access, top-up order creation, pricing queries, and error reporting. This mismatch is dangerous because it can cause the agent to invoke the skill under false pretenses and expose users to unexpected data access, charges, and credential handling.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest advertises education-history verification, but the documentation implements person work-experience queries. This is a direct semantic integrity issue that can misroute sensitive user requests and cause collection or disclosure of different personal data than the user intended.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill title and overview explicitly describe work-experience queries, contradicting the manifest's education-verification purpose. In a personnel-screening context, this increases the risk of unauthorized or improper processing of personal employment data because users and orchestrators may believe they are invoking a different function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill manifest claims education-history verification, but the referenced document exposes a work-experience API instead. This mismatch can cause the agent to retrieve and process unrelated sensitive employment data under a different business justification, creating a data-scope violation and increasing the risk of unauthorized background screening.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The title and introductory description explicitly document work-experience retrieval, contradicting the manifest's stated academic-background purpose. Such inconsistency is dangerous because reviewers, users, or calling systems may grant access based on one stated purpose while the implementation supports a different category of personal data, undermining consent and access-control expectations.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements API key issuance, account lookup, pricing, and recharge operations that are materially unrelated to the declared purpose of verifying overseas staff education history. Such scope mismatch is dangerous because it expands the skill’s privileges into billing and credential-management functions, increasing the blast radius if the skill is invoked unexpectedly or repurposed for unauthorized account actions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Creating recharge orders is not justified by candidate screening or academic background checks, so exposing this action in the skill introduces unnecessary financial functionality. An attacker or confused user could trigger payment-related operations through a skill that should only perform verification, creating risk of unintended charges or abuse of linked platform accounts.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Account balance and pricing lookups are outside the declared education-verification scope and unnecessarily expose sensitive commercial/account metadata. While not direct code execution, this broadening of functionality can leak account details and aid follow-on abuse by revealing account identifiers, balances, and service pricing to callers who only need verification results.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The module includes built-in persistence for API request/response payloads and task results, which can retain sensitive personnel education and screening data on disk longer than necessary. In this skill context, the data concerns employee/candidate background information, so local logging and result storage increase privacy, compliance, and accidental disclosure risk if the host is shared or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This file implements a remote platform error-reporting function that is outside the stated purpose of an employee education-verification skill. In a skill that handles personnel identifiers and academic records, transmitting operational error data to another endpoint increases the chance that sensitive request metadata or contextual details are sent off-scope without clear necessity or user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code sends exception data to a remote API endpoint rather than performing the advertised education-history verification task. In this skill context, that mismatch is security-relevant because failures during background checks may include highly sensitive identifiers, request paths, or academic information in the reported context, creating an unnecessary data flow to the platform.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata claims education-history verification, but the code actually queries a person's work experience via `/person/experience/list`. This semantic mismatch can cause operators or downstream agents to invoke the skill under false assumptions and retrieve employment-history data that is outside the stated purpose, creating unauthorized data access and privacy/compliance risk.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The file's docstrings and comments explicitly describe work-experience retrieval, which directly contradicts the declared education-verification function of the skill. In a background-check context, this increases the chance of collecting or exposing the wrong category of personal data, undermining consent boundaries, auditability, and least-privilege expectations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module performs outbound network access and local persistent caching that are unrelated to the stated purpose of education verification. In a personnel-screening skill, hidden auxiliary behavior expands the data flow and attack surface, and can enable unexpected telemetry or future code-path abuse even if the current payload is only the skill name.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: A self-update/version-check capability is not justified by the business function of academic background checks and introduces non-essential remote dependency behavior. Such mechanisms are risky in high-sensitivity workflows because they create covert communication channels and normalize code paths that could later be extended into automatic update or command retrieval behavior.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match common hiring and screening requests, which raises the chance of overbroad or accidental invocation. Given the manifest/behavior mismatch and the skill's ability to incur fees and access sensitive personnel data, overly broad routing materially increases misuse risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API reference describes retrieving a person's historical work experience by identifier but provides no privacy, authorization, or permitted-use warning. In the context of pre-hire screening and background validation, this omission makes misuse more likely by normalizing access to sensitive personal data without clear legal basis, consent, or least-privilege constraints.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The API documentation explicitly instructs callers to transmit request parameters, response payloads, and exception context to a centralized error-reporting endpoint. In the context of a skill handling employee education and candidate screening data, those fields can easily contain personal data, internal identifiers, or sensitive background-check information, and the note that fields are 'automatically desensitized' is not a sufficient security guarantee without clear scoping, minimization, or user-facing disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The network request reports a caller-supplied 'context' field to a remote endpoint with no visible redaction, consent, or disclosure controls. Because this skill is used for personnel screening and academic background checks, the context can easily contain employee IDs, education records, error traces, or other personal data, making silent exfiltration to telemetry infrastructure particularly risky.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The code transmits the skill name to a remote API without any user-facing disclosure or consent. While the shared datum is limited, undisclosed outbound communication is a privacy and transparency issue, especially in a skill handling employee and candidate background-check workflows where users expect tightly bounded data use.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 97% confidence
• Finding: The skill instructs the agent to inspect `~/.upkuajing/.env` for an API key and to store newly created credentials there. Accessing local credential files is dangerous because it normalizes secret discovery and persistence behavior inside a skill whose stated purpose is personnel verification, increasing the chance of credential exposure, unintended reuse, or abuse by a compromised or overly-permissive agent.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 97% confidence
• Finding: The flow allows applying for a new API key and automatically saving it to `~/.upkuajing/.env`, which combines credential issuance with local secret storage. That expands the attack surface by enabling the skill to create long-lived credentials and persist them on disk, potentially without strong separation from unrelated processes or clear lifecycle controls.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: Writing a newly issued API key directly to a .env file can expose credentials if that file has weak permissions, is synced, backed up insecurely, or accidentally committed. In the context of a skill that already exceeds its declared purpose, local secret persistence increases the risk that sensitive platform credentials are retained in a less protected form than necessary.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 91% confidence
• Finding: The dependency is specified with only a lower bound (httpx>=0.23.0), which permits uncontrolled upgrades to any future release. This can introduce breaking changes or newly introduced vulnerable/transitive versions into a security-sensitive background-check skill without review, weakening reproducibility and supply-chain control.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:61