全球公司学校详情查询，从全球公司数据库获取含名称、类型、地理位置与社媒链接的详细学校信息。帮助招聘人员、研究人员与分析师核验教育机构、研究学术关系网、丰富机构数据——适合学历核验、院校研究与学术关系网分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:13 AM UTC
• Version: 1.0.3

Overview

The skill appears to query a legitimate vendor API, but it handles API keys and home-directory state in ways users should review before installing.

Install only if you trust the upkuajing service and are comfortable with paid API use. Do not print or paste API keys in chat or terminal transcripts, set restrictive permissions on ~/.upkuajing and its .env file, review any recharge/payment URL before use, and decline error reports that would include personal or sensitive data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:38

Finding

API Key Exposure Through Unsafe Display Instructions and Plaintext Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-50, scripts/auth.py:18-34, scripts/auth.py:62-74
Vulnerability Type: Credential exposure and insecure secret storage
Risk Level: High

Vulnerable Code

SKILL.md:38-50

markdown

## API密钥与充值
使用此技能需要API密钥。API密钥保存在 `~/.upkuajing/.env` 文件中：
```bash
cat ~/.upkuajing/.env

文件内容示例：

text

UPKUAJING_API_KEY=your_api_key_here

未设置API密钥

请先检查 ~/.upkuajing/.env 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：

1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（auth.py --new_key），申请到新密钥后，会自动保存到 ~/.upkuajing/.env

text

`scripts/auth.py:18-34`

```python
# 检查是否已存在 .env 文件和 API key
env_file = UPKUAJING_ENV_FILE

if env_file.exists():
    # 读取现有的 .env 文件
    try:
        with open(env_file, 'r', encoding='utf-8') as f:
            content = f.read()
            # 检查是否已有 API key
            for line in content.splitlines():
                line = line.strip()
                if line.startswith(f'{API_KEY_ENV}='):
                    existing_key = line.split('=', 1)[1].strip()
                    if existing_key:
                        return {
                            "success": False,
                            "message": f"错误：{env_file} 中已存在API密钥（{existing_key[:10]}...）。\n如需重新申请，请先删除文件中的 {API_KEY_ENV} 后再运行此命令。",
                            "envFilePath": str(env_file)
                        }

scripts/auth.py:62-74

python

# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

T

...[truncated 2431 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to print the entire .env file.
2. Replace it with a presence-only check that never renders the value, or let the Python code report only whether the key is configured.
3. Create ~/.upkuajing with owner-only permissions equivalent to 0700.
4. Create or immediately change .env to owner-read/write permissions equivalent to 0600.
5. Do not include any portion of an existing key in status or error messages.
6. Prefer the process environment or an operating-system credential store over a plaintext file.
7. If file storage remains supported, verify that the path is a regular file owned by the current user before reading or overwriting it.
8. Document credential rotation and revocation procedures for users who may have followed the previous display instruction.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1, SKILL.md:20-22
Vulnerability Type: Unpinned dependency and missing integrity verification
Risk Level: Medium

Vulnerable Code

requirements.txt:1

text

httpx>=0.23.0

SKILL.md:20-22

markdown

### 环境准备

1. **检查 Python**：`python --version`
2. **安装依赖**：`pip install -r requirements.txt`

Technical Analysis

The lower-bound-only constraint permits pip to install any current or future version of httpx. The dependency is not locked to an audited release, no hashes are supplied, and transitive dependencies are not pinned. Consequently, the source reviewed in this audit does not fully determine the code that will execute after installation.

The package name appears legitimate, and the project does not specify a suspicious package index or direct download URL. The risk arises from unrestricted future resolution and absent integrity controls rather than an identified typosquatted package.

Because httpx handles requests carrying the Bearer credential, compromise of the dependency or one of its transitive dependencies could affect both installation-time execution and runtime handling of API keys and responses.

Attack Path

1. A user follows the documented pip install -r requirements.txt instruction.
2. pip resolves a newer release satisfying httpx>=0.23.0, along with unconstrained transitive dependencies.
3. A compromised, malicious, or otherwise unsafe permitted release is downloaded.
4. Package installation or import executes code with the privileges of the user running pip or the Skill.
5. Malicious dependency code can inspect process data, intercept Bearer credentials, alter API requests, or modify files available to that user.

Impact Assessment

Exploitation could provide arbitrary code execution with the privileges of the account performing installation or running the Skill. In that context, a mali ...[truncated 302 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin httpx to an exact release that has been tested and audited.
2. Generate a lock file that also pins all transitive dependencies.
3. Record cryptographic hashes and install with hash verification, such as pip's --require-hashes mode.
4. Explicitly document the trusted Python package index.
5. Periodically update the lock file through a controlled review process rather than permitting automatic adoption of every future release.
6. Run dependency vulnerability and provenance checks in continuous integration.
7. Recommend installation in an isolated virtual environment under a non-privileged account.

other

Note

• Location: scripts/common.py:187

Finding

Undeclared Automatic Version Telemetry and Persistent Home-Directory Cache

Content

View full analysis

Vulnerability Details

File Location: scripts/common.py:187-212, scripts/version_check.py:22-48, scripts/version_check.py:89-104, scripts/version_check.py:119-154
Vulnerability Type: Undeclared telemetry and persistent local state
Risk Level: Low

Vulnerable Code

scripts/common.py:187-212

python

def make_request(
        endpoint: str,
        params: Dict[str, Any],
        api_key: Optional[str] = None,
        require_auth: bool = True
) -> Dict[str, Any]:
    """
    向跨境魔方API发起HTTP请求。

    Args:
        endpoint: API端点路径
        params: 请求参数字典
        api_key: API密钥（如果为None且require_auth=True，将从环境变量获取）
        require_auth: 是否需要Bearer令牌认证，默认为True
    """
    # 版本检测
    check_and_notify(API_BASE_URL)

    if require_auth and api_key is None:
        api_key = get_api_key()

    url = f"{API_BASE_URL}{endpoint}"
    headers = {
        "Content-Type": "application/json"
    }

    # 只有在需要认证时才添加 Authorization 头
    if require_auth:
        headers["Authorization"] = f"Bearer {api_key}"

scripts/version_check.py:22-48

python

def get_version_cache_file() -> Path:
    """获取版本缓存文件路径"""
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
    return VERSION_CACHE_FILE


def load_version_cache() -> Dict[str, Any]:
    """加载版本缓存"""
    cache_file = get_version_cache_file()
    if cache_file.exists():
        try:
            with open(cache_file, 'r', encoding='utf-8') as f:
                return json.load(f)
        except (json.JSONDecodeError, IOError):
            return {}
    return {}


def save_version_cache(cache: Dict[str, Any]) -> None:
    """保存版本缓存"""
    cache_file = get_version_cache_file()
    try:
        with open(cache_file, 'w', encoding='utf-8') as f:
            json.dump(cache, f, ensure_ascii=False, indent=2)
    except IOError:
        pass

scripts/version_check.py:89-104

py

...[truncated 3636 chars]

Remediation

View remediation

Remediation Suggestions

1. Disclose the automatic version request and cache behavior in SKILL.md.
2. Make update checks opt-in or provide a documented setting that disables them.
3. Do not run the check automatically before every class of API operation.
4. Use the fixed Skill identifier from validated metadata rather than the installation directory basename.
5. Avoid creating ~/.upkuajing or the cache file until update checking has been explicitly enabled.
6. Apply owner-only permissions to the cache directory and file.
7. Define a retention policy and provide a command for deleting cached state.
8. Keep update checks informational only; do not download or execute update payloads without separate explicit consent and integrity verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation primarily performs version checks, cache reads/writes, and metadata processing rather than education lookup, then the description materially conceals non-obvious network and file operations. Concealed background communications and local state handling increase trust and transparency risks even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the implementation primarily performs version checks, cache reads/writes, and metadata processing rather than education lookup, then the description materially conceals non-obvious network and file operations. Concealed background communications and local state handling increase trust and transparency risks even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation primarily performs version checks, cache reads/writes, and metadata processing rather than education lookup, then the description materially conceals non-obvious network and file operations. Concealed background communications and local state handling increase trust and transparency risks even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the implementation primarily performs version checks, cache reads/writes, and metadata processing rather than education lookup, then the description materially conceals non-obvious network and file operations. Concealed background communications and local state handling increase trust and transparency risks even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation primarily performs version checks, cache reads/writes, and metadata processing rather than education lookup, then the description materially conceals non-obvious network and file operations. Concealed background communications and local state handling increase trust and transparency risks even if not overtly malicious.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Referencing cat ~/.upkuajing/.env directs the operator to print a credential file that may contain active API secrets. In the context of a networked, file-capable skill, exposing the contents of a local .env file can lead directly to credential theft and downstream unauthorized API use or billing abuse.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The workflow tells the user to provide an API key and add it to a local .env file, or to generate a new key that will be saved locally. This creates multiple insecure credential-handling paths and expands exposure through chat, local storage, and potentially insufficiently protected file writes.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Automatically saving newly issued API keys into a local .env file without strong safeguards increases the risk of credential persistence and later disclosure through file reads, backups, logs, or misconfigured permissions. In a skill that already encourages checking local secret files, this materially raises the chance of credential compromise.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a skill for retrieving school and education background details for personnel from a global company database. This file instead implements platform account management functions such as API key creation, account balance lookup, recharge order creation, and pricing queries, which are operational/authentication tasks rather than education-profile retrieval behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Writing an API key into a plaintext .env file creates a persistent local credential that may be exposed through weak filesystem permissions, backups, accidental commits, or other local disclosure paths. In an agent skill context, silent secret persistence is more dangerous because users may not expect credential material to be stored automatically.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill focused on querying company/person/school education data for due diligence and relationship analysis. This file instead collects runtime error context and sends it to a platform error-reporting endpoint, which is an operational telemetry function rather than part of the declared data-retrieval purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares capabilities that imply environment access, file read/write, and network use, but it does not define an explicit tool scope or permissions boundary. This increases risk because a host agent may grant broader execution privileges than users expect, especially since the workflow includes credential handling and remote API operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest frames the skill as person-to-school education profiling, but the documented behavior is only direct school-detail lookup by school ID. In a due-diligence context, this can cause overcollection or misuse of related personal data because operators may believe the tool is designed for person-level profiling when it is not.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation overstates the output as a complete educational background, while the described API returns only school metadata. Overstated output claims are dangerous in compliance-sensitive workflows because they can mislead users about data provenance, completeness, and suitability for due diligence decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill name suffix "-zh", the fully Chinese description, and multiple instructions such as replying with prompts and guidance in Chinese indicate a fixed-language experience. The file does not state that Chinese is optional or provide any user opt-in or alternative locale, which conflicts with the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions explicitly tell the operator to inspect a local secret file and potentially have the user provide API credentials through conversation. This is dangerous because it normalizes secret disclosure, increases the chance of exfiltrating existing keys from disk, and encourages insecure credential transmission via chat.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly encourages sending request parameters, response payloads, and error context to a centralized error-reporting API. Even though it states sensitive fields will be auto-masked, there is no explicit requirement to minimize data, obtain user approval, or prohibit inclusion of personal/educational data, which is especially relevant for a skill handling detailed school and background information. This creates a realistic risk of over-collection and secondary disclosure of personal or confidential data through logs and telemetry.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196