ClawHub
Back to skill

Security audit

Run personnel ID searches across global corporate databases to pull employees’ complete academic backgrounds. Retrieve full education credentials includingattended institutions, awarded degrees, majors and official GPA records. Recruiters, HR teams and hiring managers verify applicants’ education history andassess candidate qualifications to make data-driven hiring decisions. Streamline pre-hire screening, official background verification and end-to-endcomprehensive talent assessment.

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it advertises education verification but actually queries employment history, while also handling API keys, account actions, and paid API use.

Install only if you intend to query work-experience records, not education records, and you have authorization to process that person's employment data. Do not let the agent print `~/.upkuajing/.env`; store the API key with restrictive permissions or a credential manager, and review any top-up or paid-query action before approving it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:40
Finding

API Key Exposure Through Secret File Output Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–52
Vulnerability Type: Exposure of plaintext credentials through Agent-visible terminal output
Risk Level: Medium

Vulnerable Code

markdown
This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file content:

text
UPKUAJING_API_KEY=your_api_key_here

API Key Not Set

First check if the ~/.upkuajing/.env file has UPKUAJING_API_KEY; If UPKUAJING_API_KEY is not set, prompt the user to choose:

  1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
  2. User doesn't have one: You can apply using the interface (auth.py --new_key), the new key will be automatically saved to ~/.upkuajing/.env
text

### Technical Analysis

The Skill explicitly instructs the Agent to run `cat ~/.upkuajing/.env`. This prints the complete contents of the credential file rather than merely determining whether the required variable exists.

Displaying the file is unnecessary for the declared functionality. The runtime implementation in `scripts/common.py` already checks the process environment and the designated file for `UPKUAJING_API_KEY`. Consequently, the instruction exceeds the minimum disclosure required to authenticate API requests.

Terminal output produced during an Agent run may become part of the model context, conversation transcript, execution logs, observability records, or debugging artifacts. The command may also expose unrelated secrets if the same file contains additional environment variables.

### Attack Path

1. The Agent loads the Skill instructions while preparing an authenticated query.
2. Following `SKILL.md`, it executes `cat ~/.upkuajing/.env`.
3. The API key and any other values in the file are printed to standard output.
4. That output is captured in Agent context, execution logs, or retained transcripts.
5. A party with
...[truncated 698 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to run cat ~/.upkuajing/.env.
  2. Use a presence-only check that never prints the value, such as a dedicated script returning only whether the key is configured.
  3. Prefer the existing get_api_key() behavior or add a --check-key operation that returns a redacted status.
  4. Never place user-provided credentials directly into conversation content or command output.
  5. If diagnostic output is required, display only a fixed redacted form and avoid revealing enough characters to facilitate credential recovery.
  6. Warn users to rotate any key that has already appeared in an Agent transcript or execution log.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:65
Finding

API Key File Is Created Without Explicit Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 65–75
Vulnerability Type: Insecure local storage of a plaintext API credential
Risk Level: Medium

Vulnerable Code

python
# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

A newly issued API key is written in plaintext to ~/.upkuajing/.env, but the script does not explicitly enforce owner-only permissions on either the directory or the file. Effective permissions therefore depend on the process umask and any permissions already present on the directory or file.

Under a permissive or nonstandard umask, the file may be readable by other local users. When the file already exists, opening it with mode w truncates and overwrites it but does not correct existing permissions. The implementation also does not explicitly reject symbolic links before opening the destination.

Reading and storing the designated API key is necessary for the Skill's authenticated functionality. The vulnerability is not the credential access itself, but the failure to enforce secure storage boundaries.

Attack Path

  1. A user runs python scripts/auth.py --new_key.
  2. The API issues a new credential.
  3. The script creates or overwrites ~/.upkuajing/.env without explicitly setting owner-only permissions.
  4. A permissive umask or an already over-permissive file leaves the credential readable by another local principal.
  5. Alternatively, an attacker who can manipulate the destination path before execution may attempt a symbolic-link-based overwrite or disclosure scenar ...[truncated 676 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create ~/.upkuajing with mode 0700 and verify its owner before use.
  2. Create the credential file atomically with mode 0600, for example through os.open using O_CREAT, O_EXCL, and an explicit mode.
  3. For an existing file, verify that it is a regular file owned by the current user and enforce mode 0600 before writing.
  4. Reject symbolic links by using platform-appropriate no-follow semantics and validating the resolved path.
  5. Write to a securely created temporary file in the same directory, flush it, and atomically replace the destination.
  6. Preserve unrelated environment entries rather than unconditionally truncating the entire file, while ensuring no secret values are printed.
  7. Consider using an operating-system credential store instead of a plaintext environment file where available.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Produces Non-Reproducible Installations

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unbounded dependency resolution and supply-chain exposure
Risk Level: Low

Vulnerable Code

text
httpx>=0.23.0

Technical Analysis

The lower-bound-only constraint allows pip to install any present or future httpx release satisfying the minimum version, together with independently resolved transitive dependencies. As a result, installations are not reproducible and may change without modification to the audited Skill.

No typosquatted package, custom package source, or known malicious version was identified in the reviewed project. The risk arises from accepting unreviewed future releases and unconstrained dependency trees rather than from confirmed malicious behavior in httpx.

Because httpx handles the Skill's authenticated HTTPS traffic, an unexpected or compromised dependency release would execute inside the Skill's Python environment and operate near sensitive request headers and response data.

Attack Path

  1. A user follows the documented setup command and runs pip install -r requirements.txt.
  2. The package resolver selects the newest versions satisfying the open-ended constraint.
  3. A future compromised, malicious, or incompatible release—or one of its transitive dependencies—is resolved.
  4. The dependency executes during installation or when imported by the Skill.
  5. Malicious runtime code could access process-level data, intercept API traffic, read the configured credential, or perform actions allowed by the Python process.

This path depends on a compromised or unsafe package release being available through the configured package index; the audited repository does not itself supply such a release.

Impact Assessment

Impact would be limited by the privileges of the user running installation or executing the Skill. Within that boundary, a compromised dependency could access the API ...[truncated 236 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin httpx to a specifically reviewed version or a narrow, tested version range.
  2. Pin all transitive dependencies through a generated lock file.
  3. Use cryptographic package hashes, such as a hash-locked requirements file installed with pip --require-hashes.
  4. Retrieve packages only from a trusted, explicitly configured package index.
  5. Add automated dependency vulnerability scanning and controlled update review.
  6. Install dependencies in an isolated virtual environment without administrative privileges.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (45)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description claims candidate academic verification, but the documented behavior includes version checks, local metadata/cache writes, and upgrade notifications instead of the advertised academic data retrieval. While some of this may be operational plumbing, it is still risky because the skill may perform undisclosed network and local-write actions in a sensitive workflow.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description claims candidate academic verification, but the documented behavior includes version checks, local metadata/cache writes, and upgrade notifications instead of the advertised academic data retrieval. While some of this may be operational plumbing, it is still risky because the skill may perform undisclosed network and local-write actions in a sensitive workflow.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description claims candidate academic verification, but the documented behavior includes version checks, local metadata/cache writes, and upgrade notifications instead of the advertised academic data retrieval. While some of this may be operational plumbing, it is still risky because the skill may perform undisclosed network and local-write actions in a sensitive workflow.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description claims candidate academic verification, but the documented behavior includes version checks, local metadata/cache writes, and upgrade notifications instead of the advertised academic data retrieval. While some of this may be operational plumbing, it is still risky because the skill may perform undisclosed network and local-write actions in a sensitive workflow.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description claims candidate academic verification, but the documented behavior includes version checks, local metadata/cache writes, and upgrade notifications instead of the advertised academic data retrieval. While some of this may be operational plumbing, it is still risky because the skill may perform undisclosed network and local-write actions in a sensitive workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest says the skill verifies education history, but the body documentation states it queries work experience. This is a direct semantic inconsistency that can cause the wrong skill to be auto-invoked for sensitive background-check tasks, leading to collection or disclosure of different personal data than the user intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill targets sensitive personnel background-check data but lacks a clear user-facing warning about privacy, lawful basis, and consent requirements. In this context, that omission is dangerous because users may process education or employment records without understanding compliance obligations or the sensitivity of the data involved.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill name/manifest imply education verification, while the internal documentation explicitly describes work experience querying. In sensitive personnel contexts, this discrepancy increases the chance of improper processing of employment data under the guise of academic verification and undermines informed consent and policy enforcement.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The documentation instructs reading a local .env file containing the API key. Exposing or encouraging direct inspection of credential files increases the risk of secret disclosure to the model, logs, or downstream outputs, especially when combined with broad file-read capability and network access.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash
cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill flow includes prompting for a user-provided API key and manually adding it to ~/.upkuajing/.env, which normalizes credential handling in plain local files. This creates avoidable exposure through file persistence, local compromise, accidental display, or reuse by unrelated tools running under the same account.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

Automatically applying for and saving a new API key into ~/.upkuajing/.env introduces credential creation and persistence within a skill that is ostensibly for personnel verification. That expands the attack surface by letting the skill generate long-lived secrets and store them in plaintext, which is especially risky given the lack of explicit scope controls.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The referenced documentation exposes an API for retrieving a person's employment history, while the skill advertises education verification and academic background checks. This mismatch can cause the agent to access and process a different category of sensitive personal data than users and reviewers expect, creating privacy, consent, and purpose-limitation violations and increasing the risk of unauthorized background screening.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements API key issuance, account info lookup, recharge order creation, and pricing retrieval, which are materially unrelated to the stated purpose of verifying overseas staff education history. In a screening/background-check skill, bundling billing and credential-management capabilities expands the trust boundary and creates an opportunity for abuse, unauthorized account actions, or hidden monetization behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The script stores the newly issued API key in a plaintext .env file under the user's home area, which increases the risk of local secret disclosure through weak file permissions, backups, accidental commits, or multi-user host access. In a skill handling background-check data, compromise of the API key could enable unauthorized use of associated services and access to sensitive account operations.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script can create recharge/payment orders even though the skill is presented as an education-verification capability. Payment initiation is a sensitive action; when embedded in a background-check skill, it can be triggered unexpectedly, facilitate unauthorized charges, or conceal commercial behavior unrelated to the user’s requested task.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a skill for checking overseas staff education history by personnel ID, but this file implements exception reporting to a platform endpoint instead of any education verification logic. Sending operational telemetry about agent/skill failures is not an obvious implementation detail of candidate screening or academic background checks as described.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill metadata promises education-history verification for screening and background checks, but the code actually calls a work-experience endpoint and returns employment-history data. This creates a scope and data-purpose mismatch that can mislead downstream users or agents into collecting and using different personal data than authorized, which is especially risky in hiring and cross-border personnel contexts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares capabilities that involve environment access, local file reads/writes, and network use, but does not constrain them with an explicit tool scope. That increases the blast radius of any misuse, especially because the skill handles credentials and can trigger remote paid operations. In this context, missing scope is dangerous because the skill already mixes sensitive data access, credential handling, and external API calls.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:61