Retrieving global corporate school details, fetching detailed school informationcontaining names, types, geographic locations, and social media links from globalinstitutional-data repositories. Helping recruiters, researchers, and analysts verifyeducational institutions, research academic networks, and enrich institutionaldata—suitable for degree verification, institutional research, and academic networkanalysis

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.3

Overview

This is a paid school-lookup integration whose sensitive pieces are mostly disclosed and user-confirmed, though users should be aware it stores an API key locally and can send optional error reports.

Install only if you are comfortable using UpKuaJing's paid API, storing its API key in ~/.upkuajing/.env, and sending school lookup requests to the provider. Confirm charges before queries, review payment URLs carefully, and do not include secrets or sensitive personal data when approving optional error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions, yet the instructions clearly require reading environment variables, reading and writing files under ~/.upkuajing/.env, and making network/API calls. This hidden capability expansion undermines least-privilege expectations and can cause an agent or user to authorize broader access than the manifest implies.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is school-detail lookup, but the skill also instructs the agent to manage API keys, write credentials locally, query account/billing information, create recharge orders, and report errors to the vendor platform. This mismatch is dangerous because users may invoke a benign-seeming data-enrichment skill without realizing it can perform billing-adjacent and credential-handling actions.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements authentication, API-key provisioning, billing, pricing, and recharge workflows that are unrelated to the declared school-detail and institution-verification purpose. This mismatch is dangerous because it expands the skill's capabilities into credential and financial operations users would not reasonably expect, increasing the risk of covert data collection, unauthorized account linkage, or monetization abuse.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Recharge-order creation and billing-related operations are unjustified for an educational-institution lookup skill and can expose users to unexpected financial actions. In this context, even if the endpoint merely returns a payment URL, embedding purchase workflows in a mismatched skill increases the chance of deceptive billing, phishing-style redirection, or unauthorized spending.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: API-key application and local credential storage are not appropriate for the stated school-information purpose and represent an unnecessary credential-handling surface. In a skill that claims only institution verification, silently provisioning and storing keys can mislead users about what trust and access they are granting.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The request/response logging helpers write raw API parameters and responses to disk under the user's home directory when enabled, without redaction or user disclosure. If enabled in deployment, these logs can capture sensitive query content, identifiers, or returned data and leave a recoverable local trail beyond the stated lookup purpose.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements platform error-reporting and telemetry behavior that is not aligned with the declared purpose of a school-information lookup skill. Capability mismatch is dangerous because it can conceal unexpected data flows to a remote endpoint and expand the skill's privileges beyond what users and reviewers would reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Sending telemetry to '/agent/skill/error/report' gives the skill an additional outbound reporting channel that is unrelated to school-detail enrichment. In this context, the unjustified reporting path increases the risk of covert collection or transfer of operational and user-supplied data under the guise of error handling.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The module performs outbound network requests to a version-check API and emits upgrade notices, behavior that is unrelated to the advertised school-information lookup purpose. While this may be intended as maintenance functionality rather than overtly malicious telemetry, it still expands the attack and privacy surface by contacting a remote service during normal use and can surprise users or operators in restricted environments.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code creates and writes a persistent cache file under the user's home directory for version-check state without any clear need tied to the skill's institution-research purpose. Unnecessary persistent writes can leak usage metadata, create forensic artifacts, and violate least-privilege expectations, especially in environments where skills should not modify user home directories silently.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are broad and ambiguous, covering general institution lookup, verification, and enrichment. Overbroad triggers increase the chance the skill is auto-selected in contexts where the user did not intend a paid external API call, credential access, or vendor interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly instructs agents to send request parameters, response data, and exception context to an error-reporting API. Even though it mentions automatic desensitization for some fields, there is no explicit requirement for user notice, consent, minimization, or a prohibition on including secrets, personal data, or regulated data in stack traces and payloads. In a skill that performs institution verification and enrichment, requests and responses may contain user-supplied identifiers or other sensitive research context, making unintended data disclosure plausible.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: API logging persists both request parameters and parsed response bodies to local log files, which may include sensitive transmitted data. Even though logging is currently disabled by default, the implementation lacks sanitization, consent, or minimization, so enabling it would create a clear confidentiality risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code forwards a caller-provided 'context' field directly to a remote API without any visible sanitization, redaction, or disclosure to the user. Error context often contains request details, identifiers, stack traces, or personal data, so transmitting it can leak sensitive information to the platform and create compliance and privacy exposure.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill explicitly instructs checking for an API key in ~/.upkuajing/.env and supports workflows that add or auto-save credentials there. This is credential access and local secret handling beyond the apparent lookup purpose, and it creates risk of secret exposure, unintended persistence, or misuse by other components with filesystem access.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: This adjacent instruction repeats the credential-handling flow: checking ~/.upkuajing/.env and automatically saving a newly issued API key to that file. Automatic local persistence of secrets materially increases the risk of credential leakage and exceeds what a user would expect from a school-information skill.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 89% confidence
• Finding: The code handles API credentials via a local .env file, which creates a credential exposure risk if file permissions are weak, backups are shared, or the file is later committed or exfiltrated. Because this skill's declared purpose does not justify credential management, the presence of secret handling is more suspicious and increases the danger of unintended disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 86% confidence
• Finding: Reading an existing .env file to discover stored API keys introduces direct access to local secrets and broadens the script's credential exposure surface. In a school-information skill, this behavior is contextually inappropriate and can enable unnecessary secret harvesting or leakage through logs, errors, or future code changes.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 92% confidence
• Finding: Writing a newly issued API key into a plaintext .env file creates a durable local secret that may be readable by other users, included in backups, or accidentally uploaded to source control. This is especially risky here because the skill's published function does not prepare users for credential issuance or storage side effects.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 96% confidence
• Finding: The dependency specification uses a lower bound only (`httpx>=0.23.0`), which allows installation of any newer version, including unreviewed major releases with breaking changes or newly introduced security issues. This weakens build reproducibility and makes the skill's behavior and exposure depend on when it is installed rather than on a vetted dependency set.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The unsafe default here is the same unauthenticated key-creation behavior, expressed by the require_auth=False parameter. In the context of a school-data skill, this expands the trust boundary far beyond the expected feature set and makes abuse harder for users to anticipate.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The unsafe default here is the same unauthenticated key-creation behavior, expressed by the require_auth=False parameter. In the context of a school-data skill, this expands the trust boundary far beyond the expected feature set and makes abuse harder for users to anticipate.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60