全球公司学校详情查询，从全球公司数据库获取含名称、类型、地理位置与社媒链接的详细学校信息。帮助招聘人员、研究人员与分析师核验教育机构、研究学术关系网、丰富机构数据——适合学历核验、院校研究与学术关系网分析

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:01 AM UTC
• Version: 1.0.3

Overview

This paid school-detail lookup is purpose-aligned overall, but it deserves review because it persists API credentials locally and performs under-disclosed version and diagnostic network calls.

Install only if you are comfortable using the UPKUAJING paid API and storing its key in a local plaintext ~/.upkuajing/.env file. Run paid queries only after explicit confirmation, avoid using this on shared machines, review any error-report context before sending it, and consider tightening dependency and file-permission handling before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes reading environment files, writing credentials to disk, and making network calls. This hidden capability expansion weakens user consent and reviewability because operators may believe the skill only performs a simple lookup while it can also touch local secrets and external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The manifest presents the skill as a school-detail lookup, but the instructions also authorize API key creation, local secret storage, account inspection, recharge order creation, pricing queries, error reporting, and version-related state changes. This mismatch is dangerous because users invoking a data lookup skill may unknowingly trigger credential management, billing, or outbound reporting behaviors that exceed the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 73% confidence
• Finding: The script transmits error-report data including requestId, requestPath, and free-form context to a remote platform endpoint, but that telemetry is not justified by the stated educational-profile retrieval purpose in the provided metadata. In a due-diligence context, the context field could contain sensitive operational details or personal data, creating an unnecessary data-exfiltration and privacy risk if collected without strict minimization and disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The module performs outbound network communication and persistent local cache writes that are unrelated to the stated purpose of retrieving education-profile data. Even if intended for routine update checks, this expands the skill's behavior and trust boundary, creating undisclosed telemetry and filesystem side effects that could surprise users or violate least-privilege expectations.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code implements self-update telemetry by sending the skill name to a remote API during execution, despite this behavior not being justified by the skill's business-research function. This is dangerous because hidden network beacons can enable tracking, create compliance/privacy concerns, and provide an unnecessary channel for remote dependency on external infrastructure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly encourages sending `requestParams`, `responseData`, and detailed `context` for error reporting, while only vaguely stating that sensitive fields will be auto-masked. In a skill handling personal education records and due-diligence data, these fields can easily contain personal or confidential information, and the lack of strong guidance on minimization, redaction, and allowed content increases the risk of privacy leakage into logs or telemetry systems.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script automatically writes a newly issued API key to a local .env file without an explicit confirmation step, permission hardening, or warning about local credential persistence. In shared environments, developer workstations, or automation contexts, this can leave secrets stored in predictable locations where they may be accidentally exposed, copied, or committed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The logging helpers write full request parameters and full response bodies to local log files when enabled, which can capture sensitive personal data and API-returned records related to education/background investigations. Even though logging is disabled by default, the implementation lacks redaction, user disclosure, retention limits, and file permission hardening, so enabling it can create a privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code sends request metadata and a caller-provided context field over the network without any notice, consent, or indication of redaction in this file. Because this skill operates in customer due-diligence and education-profile workflows, the context may include sensitive personal, business, or case information, making silent transmission risky.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The version check transmits the skill identifier to a remote endpoint without any user-facing notice or consent mechanism. While the transmitted field is limited, undisclosed metadata sharing is still a security and privacy concern because it reveals installed capabilities and usage context to an external service.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs checking `~/.upkuajing/.env` for an API key and supports obtaining a new key that is automatically written to that file. Accessing and modifying local secret stores is sensitive because it exposes credential material and can persist tokens without strong scoping, rotation, or clear separation from the data-query function.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: The documented flow combines inspection of a local `.env` file with automated API-key application and persistence, creating an unnecessary credential-access path for a skill whose main purpose is school lookup. In context, this makes the skill more dangerous because it normalizes local secret file access and expands the blast radius from a simple query into credential management on the user's machine.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 71% confidence
• Finding: The code reads the existing .env file and parses out the API key in plaintext. While this is likely intended for duplicate-key prevention, plaintext secret handling increases exposure risk in local compromise scenarios and normalizes storing and processing credentials outside a secure secret manager.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: Writing an API key directly to a .env file stores a live credential in plaintext on disk. If the host is shared, backed up insecurely, indexed by tooling, or the file is accidentally committed, an attacker could reuse the key to access the upstream account or APIs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only (httpx>=0.23.0), which allows installation of any newer version, including future releases with breaking changes or newly introduced vulnerable transitive dependency constraints. While this is a common packaging mistake rather than an exploit by itself, it weakens build reproducibility and can expose the skill to supply-chain risk if an unsafe version is later resolved.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196