全球公司人员搜索，按姓名、公司、行业与档案 URL 从全球公司数据库找人。帮助招聘人员、销售团队与 B2B线索构建者发掘全球联系人、寻源候选人、丰富联系数据——适合人才搜索、猎头、线索开发与跨国客户获取。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:52 AM UTC
• Version: 1.0.3

Overview

This is a disclosed paid people-search integration, with sensitive but purpose-aligned handling of API keys, billing links, remote queries, and local result files.

Install only if you are comfortable sending search inputs and results through Upkuajing's API, paying for API calls after confirmation, and storing the API key locally in ~/.upkuajing/.env. Do not paste secrets into error reports, and review generated task_data files because they may contain personal or business lead data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet the documentation clearly instructs use of environment variables, local file reads/writes, and networked API calls. This creates a transparency and least-privilege problem: operators may authorize or run the skill without understanding that it can access credentials, persist data locally, and initiate external requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is person search, but the skill also includes account provisioning, balance checks, payment order creation, pricing queries, error reporting, remote version checks, and local task/result persistence. This functional overreach increases attack surface and can lead to unexpected credential handling, spending, outbound data transfer, and hidden state retention beyond what a user would reasonably expect from a search skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements authentication, API key provisioning, account lookup, recharge order creation, and pricing queries, which materially exceed the declared skill purpose of global company/person search. This kind of scope mismatch is dangerous because it introduces billing and credential-management capabilities that a user would not reasonably expect from a search skill, increasing the attack surface and the chance of misuse or deceptive bundling.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Recharge-order creation and pricing-query functionality are unrelated to person-search behavior and give the skill access to payment-adjacent operations. In a search-oriented skill context, these features can enable unexpected charges, social engineering around payment flows, or concealed monetization paths that users did not intend to invoke.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Account-information retrieval and API key lifecycle management are sensitive capabilities that do not match the stated search-only purpose. In this context, they are more dangerous because they handle credentials and account state, which can expose secrets, facilitate unauthorized API use, or normalize hidden access-management behavior inside an otherwise innocuous skill.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill performs automatic outbound version-check traffic unrelated to its stated person-search function, creating undisclosed network behavior and an extra trust channel to a remote service. In a skill context, this increases privacy and supply-chain risk because the component can contact external infrastructure even when the user only expects local helper behavior around the declared feature set.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The reference documents an API for searching identifiable people and filtering by the presence of contact channels such as phone, email, WhatsApp, website, and social accounts, while returning detailed person and employer profile fields. In a lead-generation/outbound-sales skill context, exposing or operationalizing this kind of people-search capability without any privacy, consent, lawful-use, or anti-abuse constraints materially increases the risk of privacy misuse, profiling, and targeted outreach at scale.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and exception context to an error-reporting endpoint, which can easily include personal data, business-sensitive information, access tokens, stack traces, or internal identifiers. Although it states that sensitive fields will be automatically masked, it provides no explicit data-minimization rules, no user/operator warning, and no guarantee that all sensitive content inside free-form fields such as context, requestParams, or responseData will be safely redacted before transmission.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code sends arbitrary request parameters to a third-party remote API with no disclosure, consent, redaction, or data-minimization guard in this file. In a person-search skill, those parameters may include names, employer, industry, profile URLs, or other personal/business data, creating a real privacy and data-exposure risk if users are unaware or if sensitive inputs are forwarded unnecessarily.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script forwards caller-supplied request metadata and free-form context to a remote API endpoint, but performs no minimization, redaction, or consent/notice handling before transmission. If the context or request fields contain secrets, personal data, or sensitive business information from agent executions, this can leak data off-box to the platform and expand privacy/compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code automatically transmits the skill name to a remote API without a user-facing warning or consent flow. While the payload is small, undisclosed telemetry/network transmission is a real privacy issue and can also enable environment fingerprinting or tracking when combined with server-side logs and timing data.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs checking and using a credential stored in ~/.upkuajing/.env and supports automatic key application and persistence. Any skill behavior that reads from or writes to a secrets file is sensitive because it can expose API keys, overwrite existing credentials, or normalize unsafe secret handling in a broadly accessible location.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: The follow-on instruction to save newly issued API keys automatically into ~/.upkuajing/.env is a credential-handling risk. Automatic persistence of secrets to a local plaintext file can expose them to other processes, accidental disclosure, or later misuse, especially in an agent environment where file access may be broader than the user expects.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 81% confidence
• Finding: The script reads the entire .env file content and parses out the API key, which is sensitive credential material. In combination with the later behavior that echoes part of the existing key in an error message, this increases the chance of accidental secret disclosure through logs, terminal history, or downstream tool output.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 94% confidence
• Finding: The code writes a freshly issued API key to a plain-text .env file under the user's home directory, creating a durable local secret that may be exposed through weak file permissions, backups, sync tools, or other local processes. In a search skill context, embedding credential issuance and persistence is especially risky because users may not expect the skill to create long-lived authentication material on disk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is only lower-bounded (`httpx>=0.23.0`) and not pinned to a specific version or constrained range, which can lead to non-reproducible installs and accidental adoption of a future vulnerable or breaking release. In a skill that likely performs network lookups against external company/person data sources, dependency drift in an HTTP client increases supply-chain and reliability risk because behavior may change silently across environments.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196