Retrieving global corporate school details, fetching detailed school informationcontaining names, types, geographic locations, and social media links from globalinstitutional-data repositories. Helping recruiters, researchers, and analysts verifyeducational institutions, research academic networks, and enrich institutionaldata—suitable for degree verification, institutional research, and academic networkanalysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.3

Overview

The skill largely performs the advertised school lookup, but its credential handling, paid-account helpers, and hidden version check need manual review before installation.

Install only if you are comfortable with a paid UpKuaJing integration that reads and stores an API key locally. Do not let the agent run `cat ~/.upkuajing/.env` or paste the key into chat/logs; prefer an environment variable or a securely permissioned file, confirm every fee-incurring query or top-up action, and be aware that normal API calls also perform an undisclosed version check.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Credential File Contents Are Printed During API Key Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-48
Vulnerability Type: API credential disclosure through terminal and agent output
Risk Level: Medium

Vulnerable Code

markdown

This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file content:

text

UPKUAJING_API_KEY=your_api_key_here

API Key Not Set

First check if the ~/.upkuajing/.env file has UPKUAJING_API_KEY;

text

### Technical Analysis

The Skill instructs the agent to run `cat ~/.upkuajing/.env` when checking whether the required API key is configured. This prints the entire credential file instead of checking only whether the named variable exists.

Terminal output may be captured in agent context, conversation transcripts, execution logs, observability platforms, or shell history-related tooling. The file could also contain additional credentials beyond `UPKUAJING_API_KEY`, all of which would be exposed by this command.

Reading the specific UpKuaJing API key internally is necessary to authenticate requests. Printing the complete credential file is not necessary and exceeds the minimum access behavior required by the declared school-detail lookup.

### Attack Path

1. A user invokes the Skill without an API key already present in the process environment.
2. The agent follows the documented setup procedure and executes `cat ~/.upkuajing/.env`.
3. The API key and any other values in the file are written to observable command output.
4. That output is retained in an agent transcript, terminal log, monitoring system, or other accessible execution record.
5. A party able to access the retained output extracts the Bearer token.
6. The exposed token is reused against UpKuaJing endpoints for authenticated and potentially billable operations.

### Impact Assessment

Disclosure provides access equivalent to the exposed UpKuaJing API k
...[truncated 424 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to print the .env file.
• Prefer checking the process environment without displaying the value.
• If the fallback file must be checked, parse it internally and report only whether UPKUAJING_API_KEY is present.
• Never include the full key in standard output, standard error, agent messages, or logs.
• If key identification is necessary, display only a short, non-sensitive suffix rather than the beginning of the token.
• Add explicit documentation warning users not to paste API keys into conversations or command output.
• Review existing transcripts and logs produced by this workflow and rotate any key that may have been exposed.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:61

Finding

API Key File Is Created Without Enforced Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 61-74
Vulnerability Type: Insecure local storage of an API credential
Risk Level: Medium

Vulnerable Code

python

# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The key-issuance workflow saves the returned API key in ~/.upkuajing/.env, but neither the containing directory nor the credential file is assigned an explicit restrictive mode. Their effective permissions therefore depend on the process umask and any permissions already present.

On a system with a permissive umask, the file may be readable by other local users. If the file already exists with insecure permissions, opening it with write mode truncates and rewrites the content but does not correct the existing mode. The implementation also does not explicitly reject a symbolic link at the destination, leaving avoidable risk when the user’s home directory or .upkuajing path is writable by another principal.

Storing this specific API key is consistent with the Skill’s authenticated functionality. Failing to protect the stored secret is not necessary and violates least-privilege credential-storage practices.

Attack Path

1. A user runs python scripts/auth.py --new_key.
2. The service returns a new API key.
3. The script creates or rewrites ~/.upkuajing/.env using permissions inherited from the current umask or existing file.
4. On a multi-user system with permissive permissions, another local account reads the file.
5. The other account extracts UPKUAJING_API_KEY.
6. The at ...[truncated 821 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700 and verify or correct the mode when the directory already exists.
• Create the credential file atomically with mode 0600, such as by using os.open with O_CREAT, O_EXCL, and an explicit mode.
• If replacing an existing file, write to a securely created temporary file in the same directory and atomically rename it.
• Reject symbolic links and verify that the final destination is a regular file owned by the current user.
• Apply chmod(0o600) to approved existing credential files before writing.
• Avoid silently overwriting unrelated .env content.
• Prefer an operating-system credential store or secret manager when available.
• Document key rotation procedures for users who discover that the file was readable by other accounts.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Dependency Version Produces Non-Reproducible Installations

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

text

httpx>=0.23.0

Technical Analysis

The project permits any httpx release at or above version 0.23.0. This makes installation results dependent on the package version available at installation time and allows future, unreviewed major releases to be selected automatically.

No typosquatted package, malicious package source, or known malicious dependency was identified in the audited project. The risk is instead that future behavior, compatibility, or security properties can change without a corresponding review of the Skill. This is particularly relevant because httpx processes requests carrying the API Bearer token.

Attack Path

1. A user follows the documented setup procedure and runs pip install -r requirements.txt.
2. The package resolver selects a future release satisfying the unbounded lower constraint.
3. That release has not been tested or audited with this Skill.
4. A compromised, vulnerable, or behaviorally incompatible release executes when imported or used for HTTP requests.
5. The Skill’s network operations, availability, or credential confidentiality may be affected.

This is a supply-chain hardening weakness rather than evidence that the currently named dependency is malicious.

Impact Assessment

The possible impact depends on the behavior of the subsequently resolved dependency version. Because the dependency runs in the Python process, it could theoretically access the process environment, local files available to the user, request bodies, and Authorization headers.

Under normal package behavior, the more likely impact is compatibility failure or unexpected request handling. Exploitation requires a harmful or vulnerable dependency release to be selected during a future installation.

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a reviewed version or use a narrowly bounded compatible range.
• Generate and commit a lock file containing resolved transitive dependencies.
• Use package hashes during installation to verify artifact integrity.
• Regularly review and deliberately update pinned versions for security fixes.
• Test dependency upgrades before publishing a new Skill version.
• Use trusted package indexes and disable unintended fallback indexes in deployment environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version/update checking and local version-cache writes are unrelated to the stated educational-institution lookup purpose, yet they introduce additional outbound communication and filesystem modification. Unrelated management-plane behavior increases the attack surface and complicates trust analysis because the skill is doing more than users are told.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Version/update checking and local version-cache writes are unrelated to the stated educational-institution lookup purpose, yet they introduce additional outbound communication and filesystem modification. Unrelated management-plane behavior increases the attack surface and complicates trust analysis because the skill is doing more than users are told.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version/update checking and local version-cache writes are unrelated to the stated educational-institution lookup purpose, yet they introduce additional outbound communication and filesystem modification. Unrelated management-plane behavior increases the attack surface and complicates trust analysis because the skill is doing more than users are told.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version/update checking and local version-cache writes are unrelated to the stated educational-institution lookup purpose, yet they introduce additional outbound communication and filesystem modification. Unrelated management-plane behavior increases the attack surface and complicates trust analysis because the skill is doing more than users are told.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly instructs reading ~/.upkuajing/.env to access the API key, which is a sensitive credential store. Any skill that reads secrets from local files increases the risk of accidental disclosure, misuse by downstream commands, or expansion into broader credential harvesting behavior.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The workflow directs the agent to check for the API key in a local .env file and, if absent, participate in a flow that causes a new key to be generated and saved locally. This combines credential discovery with credential creation and persistence, which is highly sensitive behavior for a skill whose public purpose is only data lookup.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Automatically saving a newly created API key into ~/.upkuajing/.env creates a persistent local secret without strong guarantees about file permissions, auditability, or whether the user intended long-term storage. In the context of a school-data enrichment skill, this is especially risky because the credential-management behavior is far more sensitive than the advertised task.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements authentication, API-key issuance, account balance lookup, and recharge workflows, which are materially unrelated to a skill advertised as school-information and institution-verification research. This kind of scope mismatch is dangerous because it introduces sensitive credential and billing capabilities into a context where users would not reasonably expect them, increasing the chance of covert monetization, account abuse, or unauthorized data collection.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

This code reads an existing .env file to inspect whether an API key is already present, meaning plaintext credentials are accessed from local storage. In the context of an unrelated school-lookup skill, this is more suspicious and dangerous because it normalizes secret handling in a component that should not need credential-file access.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The code writes a newly issued API key directly into a local .env file, creating plaintext secret persistence on disk. This is dangerous because local files are commonly exposed via backups, logs, developer tooling, or permissive file permissions, enabling credential theft and downstream account abuse.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Recharge-order creation, account-info retrieval, and pricing queries are not justified by a school-detail lookup skill and expose financial/account operations under a misleading feature label. In context, this makes the skill more dangerous because users invoking institution research are less likely to scrutinize hidden payment-related behaviors.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for obtaining and verifying educational institution details, but this file implements exception reporting to a platform endpoint, including collecting request metadata and sending it externally. Operational telemetry/reporting is not part of the stated school-information or academic-network research functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents capabilities to read environment variables, read/write local files, and perform network actions, but it does not declare any explicit tool scope or permissions boundaries. That mismatch weakens reviewability and least-privilege controls, increasing the chance that an agent executes sensitive filesystem or network operations beyond what a user expects from a school-detail lookup skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly allows sending request parameters, response payloads, and exception context to a central error-reporting endpoint. Even though it states sensitive fields are 'automatically desensitized,' it provides no concrete guarantees, user warning, field-level policy, or prohibition on including secrets, personal data, or regulated information in free-form context and serialized payloads. In a skill that performs institution verification and enrichment, those payloads may include user-supplied identifiers, lookup targets, and third-party response content, making privacy leakage through telemetry a realistic risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language descriptions, help text, and output messages entirely in Chinese, including the module docstring and CLI help, with no indication that language selection is optional. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code applies for a new API key and persists it locally even though the declared skill purpose is institution research, not credential provisioning. This context-inappropriate credential handling expands the attack surface and can lead to silent credential creation, storage, and later misuse without clear user expectation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language documentation and runtime messages in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-language context. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.