全球公司人员搜索，按姓名、公司、行业与档案 URL 从全球公司数据库找人。帮助招聘人员、销售团队与 B2B线索构建者发掘全球联系人、寻源候选人、丰富联系数据——适合人才搜索、猎头、线索开发与跨国客户获取。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.0.3

Overview

This skill appears purpose-aligned, but it needs Review because it handles API keys and person-search data in ways that can expose sensitive information.

Install only if you trust the publisher and need this paid people-search service. Do not run the documented cat command on the API key file; use a secure environment variable or ensure ~/.upkuajing/.env is owner-only. Confirm costs before searches, avoid unlawful or abusive person targeting, and delete stored task_data results when they are no longer needed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:36

Finding

Credential Disclosure Through Documented File Inspection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-45
Vulnerability Type: Exposure of a bearer credential through command output
Risk Level: Medium

Vulnerable code snippet:

markdown

## API密钥与充值
使用此技能需要API密钥。API密钥保存在 `~/.upkuajing/.env` 文件中：
```bash
cat ~/.upkuajing/.env

文件内容示例：

text

UPKUAJING_API_KEY=your_api_key_here

未设置API密钥

请先检查 ~/.upkuajing/.env 文件是否有 UPKUAJING_API_KEY;

text

### Technical Analysis

The Skill instructs the Agent to run `cat ~/.upkuajing/.env` to determine whether an API key has been configured. This prints the complete contents of a secret-bearing file rather than checking only whether the required variable exists.

The resulting bearer token may enter the Agent's context, terminal transcripts, execution logs, monitoring systems, or chat output. Reading the credential value is unnecessary for the declared search functionality because `scripts/common.py` already loads the key internally and can report when it is absent.

This behavior exceeds least privilege: the Agent needs to know whether authentication is available, but it does not need to display or retain the credential itself.

### Attack Path

1. A user or Agent follows the documented credential-check procedure.
2. The command prints the complete `.env` file, including `UPKUAJING_API_KEY`.
3. The output is retained in an Agent context, terminal log, transcript, or observability system.
4. A party with access to that output extracts the bearer token.
5. The party submits authenticated requests to the vendor API using the victim's account and balance.

### Impact Assessment

Exposure grants the ability to authenticate as the affected API account within the permissions associated with the bearer token. A party possessing the token may issue paid searches, retrieve account information, create payment-related requests, or consume the account balance. This does not directly grant opera
...[truncated 124 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to print the .env file.
• Add a dedicated command that reports only whether the key exists, never its value.
• Prefer environment-variable authentication and allow get_api_key() to report a missing key.
• If shell-based checking is unavoidable, ensure that the command produces only a fixed status message.
• Redact bearer tokens from terminal output, Agent context, exception messages, and application logs.
• Rotate any API key that has already appeared in execution transcripts.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:63

Finding

API Key Stored Without Explicit Owner-Only Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 63-74
Vulnerability Type: Insecure plaintext credential storage permissions
Risk Level: Medium

Vulnerable code snippet:

python

# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The newly issued bearer token is written in plaintext to ~/.upkuajing/.env. Neither the directory nor the file is assigned an explicit owner-only mode. Path.mkdir() and open() therefore rely on the process umask and pre-existing path permissions.

Under a permissive umask or when ~/.upkuajing already has unsafe permissions, another local account may be able to read the credential. The implementation also does not verify whether the destination is a symbolic link or whether an existing file is securely owned before overwriting it.

Attack Path

1. The Skill runs under an environment with a permissive umask, unsafe pre-existing directory permissions, or an attacker-prepared destination.
2. auth.py --new_key requests a new bearer token.
3. The token is written to .env using process-default permissions.
4. Another local user or process reads the file.
5. The stolen token is used to authenticate to the fixed vendor API as the victim.

The path is conditional on local filesystem access and insecure effective permissions, but the code does not enforce the security invariant itself.

Impact Assessment

Successful exploitation exposes the complete API bearer token. The attacker obtains the API privileges and billing scope of the affected account, including the ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700.
• Create the credential file atomically with mode 0600, such as by using os.open() with restrictive flags and permissions.
• Apply chmod(0o600) after creation as defense in depth.
• Reject symbolic-link destinations and verify that existing files are regular files owned by the current user.
• Avoid overwriting unrelated .env content; update only the required variable through an atomic temporary-file replacement.
• Prefer an operating-system credential store where available.
• Inspect and repair permissions on existing installations.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/common.py:473

Finding

Person Search Results Stored Without Explicit Access Controls

Content

View full analysis

Vulnerability Details

File Location: scripts/common.py, lines 473-483
Vulnerability Type: Insecure local storage of person-search data
Risk Level: Medium

Vulnerable code snippet:

python

def append_result_data(task_id: str, data_list: list) -> None:
    """
    追加结果数据到任务结果文件。
    """
    result_file = get_task_result_file(task_id)
    ensure_task_dir(task_id)
    with open(result_file, 'a', encoding='utf-8') as f:
        for item in data_list:
            f.write(json.dumps(item, ensure_ascii=False) + '\n')

Technical Analysis

API results are persisted beneath the project-level task_data directory using default directory and file permissions. The code does not explicitly restrict access to the executing user, verify the permissions of existing task directories, or set a retention policy.

These records contain person and company identifiers and may include contact-related information returned by the service. Even where a particular query returns only contact counts, the persistent dataset remains potentially sensitive business and personal information.

UUID validation protects against direct path traversal through task_id, but it does not protect confidentiality from other local users or processes that can access the project directory.

Attack Path

1. A user performs a person search.
2. The Skill creates task_data/<task-id>/result.jsonl using process-default permissions.
3. The project directory or generated files are readable by another local user, shared service, backup process, or artifact collector.
4. That party copies the stored person-search records.
5. The records are used or disclosed outside the intended search session.

Impact Assessment

Exploitation may disclose collected personal and business information, search targets, company associations, and contact-related data. The scope is limited to locally stored task metadata and results that the ...[truncated 107 chars]

Remediation

View remediation

Remediation Suggestions

• Create task_data and each task directory with mode 0700.
• Create result and metadata files with mode 0600.
• Verify ownership, file type, and permissions before appending to an existing file.
• Document where results are stored, what information they may contain, and how users can delete them.
• Add a configurable retention period and secure cleanup mechanism.
• Avoid storing results when persistence is not needed, or allow callers to select a protected output directory.
• Ensure logs, backups, and artifact collection systems do not automatically ingest these files.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Non-reproducible dependency resolution
Risk Level: Low

Vulnerable code snippet:

text

httpx>=0.23.0

Technical Analysis

The dependency declaration specifies only a minimum version and has no upper bound, lock file, or artifact hash. A future installation may therefore resolve a release that was not included in this audit.

Because httpx executes in the same Python process that handles the API bearer token, request parameters, account information, and person-search responses, a compromised or unexpectedly incompatible dependency release would inherit access to that process's data and privileges.

No evidence indicates that the named package is currently malicious. The finding concerns unsafe and non-reproducible supply-chain configuration rather than a confirmed malicious package.

Attack Path

1. The user runs the documented dependency installation command.
2. The package resolver selects a later release permitted by the unbounded version constraint.
3. That release contains a malicious compromise, dependency-chain compromise, or security-relevant incompatibility.
4. The package is imported by the Skill.
5. The compromised code executes with the Skill process's filesystem, network, environment-variable, and credential access.

Impact Assessment

In the worst case, compromised dependency code could read the API key, inspect search parameters and responses, modify requests, or access files available to the user running the Skill. Actual impact depends on a compromised or vulnerable package version being resolved; the current project does not itself demonstrate such a compromise.

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a specifically reviewed version or narrowly reviewed compatible range.
• Generate a lock file containing complete transitive dependency versions.
• Require cryptographic hashes for downloaded packages where supported.
• Install from a trusted package index over authenticated TLS.
• Run dependency vulnerability and provenance checks in CI.
• Review and test dependency upgrades before changing the lock file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated purpose is contact discovery, but the detected behavior includes remote version checks, local metadata reads, home-directory cache writes, and upgrade notices. Even if intended for maintenance, these side behaviors expand the attack surface and create undisclosed network and filesystem activity beyond the user-facing purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated purpose is contact discovery, but the detected behavior includes remote version checks, local metadata reads, home-directory cache writes, and upgrade notices. Even if intended for maintenance, these side behaviors expand the attack surface and create undisclosed network and filesystem activity beyond the user-facing purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated purpose is contact discovery, but the detected behavior includes remote version checks, local metadata reads, home-directory cache writes, and upgrade notices. Even if intended for maintenance, these side behaviors expand the attack surface and create undisclosed network and filesystem activity beyond the user-facing purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs the agent to read ~/.upkuajing/.env, which is a credential-bearing file containing the API key. Directing an agent to access secret storage is dangerous because it normalizes secret retrieval from disk and can lead to accidental disclosure, overcollection of credentials, or reuse of secrets outside the minimum necessary flow.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The workflow tells the agent to inspect a local .env file for an API key and to guide the user into storing secrets there. This creates a credential-handling path inside a skill whose primary purpose is search, increasing the chance of secret exposure and mixing sensitive authentication state with ordinary task execution.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill can request a new API key and automatically save it into ~/.upkuajing/.env, combining credential issuance with local secret persistence. This is sensitive because it grants the skill the ability to create and store authentication material on the user's system, which can be abused by compromised code paths or insufficiently constrained agent tools.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for searching global company personnel by name, company, industry, and profile URL. This script instead manages API key issuance, reads account information, creates recharge payment orders, and queries API pricing, which are operational/account-management behaviors outside the described search capability.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The code reads the full .env file and then includes a prefix of the existing API key in a user-facing message. Even partial secret disclosure increases the risk of credential leakage through logs, terminal history, screenshots, or shared outputs, especially in agent or multi-user environments.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The code writes a newly issued API key in plaintext to a .env file under the user’s home directory without any visible permission hardening or secure storage mechanism. If the file is readable by other local users, backup tools, or agent infrastructure, the credential can be stolen and used to access the associated account and APIs.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares capabilities that involve environment access, local file reads/writes, and network use, but it does not define any explicit tool scope or permission boundaries. In an agent environment, this creates unnecessary ambient authority and makes it harder to constrain or audit sensitive operations such as reading API keys from disk or writing credential data to the user's home directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill name, title, and operating description are entirely Chinese and present the skill as Chinese-language only, with no indication that the user may choose another language. This can violate language/locale policy when a skill imposes a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The API explicitly supports searching for individuals and filtering on the existence of phone, WhatsApp, email, website, and social accounts, which materially increases the ability to identify and target people at scale. In the context of a people-search skill for sales/outreach, the lack of any privacy, consent, lawful-use, or anti-abuse safeguards makes this a real privacy and misuse risk rather than a purely informational issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly supports sending request parameters, response data, and error context to an error-reporting endpoint. Even though it says sensitive fields are automatically masked, there is no explicit guidance to minimize telemetry, avoid personal/company data, or obtain user/operator awareness before transmitting potentially sensitive content. In a person-search skill, request and response payloads may contain names, employer details, profile URLs, and debugging context that can expose personal or business-sensitive information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module title, description, CLI help text, and user-facing messages are all written exclusively in Chinese, with no indication that other languages are supported or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code implements a generic telemetry channel for reporting execution failures to a platform service, which creates an outbound data path unrelated to the core people-search function. Such side-channel reporting can expose identifiers, request paths, and free-form context that may include proprietary inputs or personal data, especially when no scoping or sanitization is enforced.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends request metadata and arbitrary context to a remote platform error-reporting endpoint, and the context can easily contain sensitive operational or user data. In a skill whose stated purpose is personnel search, this telemetry is not necessary to deliver the advertised function, which increases the risk of undisclosed data exfiltration beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script transmits request and context data to '/agent/skill/error/report' without any user-facing disclosure in the script flow about what categories of data may be sent. If the context includes user prompts, internal URLs, identifiers, or business data, this can result in silent leakage to a central platform and create compliance and privacy exposure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196