Pinpointing global corporate personnel, locating individuals from global corporatedatabases by name, company, industry, and profile URL. Helping recruiters, sales teams,and B2B lead-generation specialists discover global contacts, source candidates, andenrich contact data—suitable for talent search, headhunting, lead development, andcross-border customer acquisition.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its stated people-search purpose, but it handles paid API credentials, payment/order flows, hidden version checks, and retained contact-search results in ways users should review before installing.

Install only if you are comfortable giving this skill access to an UpKuaJing API key and using it for paid people-search requests. Avoid displaying the .env file contents, restrict permissions on ~/.upkuajing and saved task data, delete retained result files when no longer needed, and confirm any fee-incurring or top-up operation before it runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:18

Finding

API Key Disclosure and Insecure Credential Storage

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/common.py:421

Finding

Personal-Data Search Results Persist Without Explicit Access Controls or Retention

Content

View full analysis

str: """ 确保任务目录存在，如果不存在则创建。 """ task_dir = get_task_dir(task_id) os.makedirs(task_dir, exist_ok=True) return task_dir ``` `scripts/common.py:475-482`: ```python def append_result_data(task_id: str, data_list: list) -> None: """ 追加结果数据到任务结果文件。 """ result_file = get_task_result_file(task_id) ensure_task_dir(task_id) with open(result_file, 'a', encoding='utf-8') as f: for item in data_list: f.write(json.dumps(item, ensure_ascii=False) + '\n') ``` `scripts/global_company_person_search.py:137-151`: ```python # 保存数据到文件 if person_list: append_result_data(task_id, person_list) total_retrieved += len(person_list) # 显示进度 progress = (total_retrieved / args.query_count) * 100 print(f"进度：{total_retrieved}/{args.query_count} ({progress:.1f}%)") if fee: total_cost += fee.get("apiCost", 0) account_balance = fee.get("accountBalance", 0) # 更新任务元数据 ``` ### Technical Analysis The Skill persists personnel records to `task_data//result.jsonl` and stores related search parameters in task metadata. Directories and files are created using default process permissions, so their confidentiality depends on the ambient umask and permissions of the installed project directory. The API contract indicates that records may contain names, employers, country information, positions, industry information, gender, and counts of available contact or social details. Query metadata can additionally reveal the organizations, people, locations, or contact criteria in which the user is interested. No explicit owner-only mode is ...[truncated 1343 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party Dependency Is Not Reproducibly Pinned

Content

View full analysis

=0.23.0 ``` ### Technical Analysis The dependency declaration accepts version `0.23.0` and every later release, with no upper bound, exact lock, or package hash. Following the documented installation command can therefore install a dependency version that was not present when the Skill was audited. This is not evidence that the legitimate `httpx` package is malicious. The security issue is the lack of reproducibility and integrity controls: future compromised, incompatible, or behavior-changing releases can enter the environment without a corresponding Skill change or renewed review. Because Python packages execute code during installation and import, dependency compromise can affect the privileges of the user installing or running the Skill. ### Attack Path 1. A user runs `pip install -r requirements.txt` as directed by the Skill documentation. 2. The package resolver selects the newest release satisfying `httpx>=0.23.0`. 3. That release may be newer than the audited version and is not checked against an expected artifact hash. 4. If the selected package or one of its transitive dependencies is compromised, malicious installation or import-time code executes with the user's privileges. 5. Such code could access the API key, locally persisted personnel data, or other files accessible to the user. ### Impact Assessment The maximum theoretical impact of a compromised Python dependency is arbitrary code execution with the privileges of the account performing installation or running the Skill. This could expose the UpKuaJing credential and search results or modify user-accessible files. The observed project does not use a typosquatted package name or an untrusted package index, so the likelihood is lower than for a known malicious dependen ...[truncated 94 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also appears to perform version/update checks, local metadata reads, and cache writes in the user's home directory, none of which are disclosed in the primary purpose. Hidden update-check behavior expands the trust boundary and can create privacy leakage or unexpected filesystem changes unrelated to the user's search request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also appears to perform version/update checks, local metadata reads, and cache writes in the user's home directory, none of which are disclosed in the primary purpose. Hidden update-check behavior expands the trust boundary and can create privacy leakage or unexpected filesystem changes unrelated to the user's search request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also appears to perform version/update checks, local metadata reads, and cache writes in the user's home directory, none of which are disclosed in the primary purpose. Hidden update-check behavior expands the trust boundary and can create privacy leakage or unexpected filesystem changes unrelated to the user's search request.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs reading ~/.upkuajing/.env directly and even shows cat ~/.upkuajing/.env, which can expose the full API key to the agent or to logs/output if mishandled. Credential access is especially dangerous here because the same skill also supports network actions, account operations, and billable API usage, creating a realistic path from secret retrieval to misuse.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The documented flow tells the agent to check the local env file for UPKUAJING_API_KEY and, if absent, guide manual insertion or create a new key automatically saved to disk. This combines credential discovery, credential creation, and persistent local storage in a skill whose headline function is search, greatly expanding the blast radius if the skill is over-invoked or abused.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Automatically saving newly created API keys to ~/.upkuajing/.env encourages plaintext secret persistence in a predictable filesystem location. In the context of a network-enabled, file-capable agent skill, predictable local secret storage materially raises the risk of later disclosure, reuse, or unauthorized billing/account access.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The code reads an existing .env file and parses out an API key, then later includes a prefix of that key in a user-visible message. Accessing and partially disclosing stored credentials increases exposure risk, especially on shared terminals, logs, screenshots, or support transcripts. In the context of a personnel-search skill, this is more dangerous because credential handling is ancillary to the core function and broadens sensitive-data processing unnecessarily.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The code writes the API key in plaintext to a .env file under the user's home directory. Plaintext local secret storage is vulnerable to disclosure via weak file permissions, backups, other local processes, accidental commits, or operator mishandling. Because this skill also exposes account and billing functions, compromise of the key could enable unauthorized use and financial abuse.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior includes reading environment variables, accessing local files, writing to user directories, and making network requests. Without an allowlist, an agent may invoke broader capabilities than users expect, increasing the risk of unauthorized credential access, data exfiltration, or unintended side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description lists trigger phrases such as "find international business contacts" and "contact-data enrichment," which are broad natural-language requests rather than specific invocation commands. The file does not provide exclusion conditions or negative examples, so the activation boundary is unclear and may cause unintended invocation for ordinary user requests in adjacent domains.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill markets person/contact-data enrichment without a clear privacy notice, retention disclosure, or warning about handling personal/business contact data. In this context, the absence of a privacy warning is more concerning because the skill is explicitly designed for recruitment and lead generation, where personal data misuse and compliance violations are realistic risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The API reference explicitly supports filtering for the existence of phone numbers, WhatsApp, email, websites, and social accounts for identified individuals, but provides no privacy, lawful-basis, or acceptable-use constraints. In the context of head-hunting and overseas sales-lead development, this materially enables targeted collection and prioritization of personal contact data for outreach, increasing risk of privacy violations, spam, and misuse of personal data across jurisdictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The returned profile fields include sensitive or privacy-relevant personal attributes such as name, country, gender, title/level, industries, contact-count indicators, and profile linkage metadata, yet the reference omits any warning about sensitive-data handling. Because the skill is specifically marketed for executive head-hunting and cross-border lead enrichment, the absence of safeguards makes profiling, discrimination, and privacy-invasive targeting more dangerous.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file adds API-key provisioning, account lookup, pricing, and recharge/billing flows to a skill whose stated purpose is personnel search and contact enrichment. Capability expansion beyond the declared use case increases attack surface and can surprise operators by introducing credential and payment operations that are not necessary for simple lookup behavior.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The explicit unsafe default require_auth=False for key creation weakens trust boundaries and normalizes bypass of authentication for a sensitive operation. Even if intended for self-service onboarding, making the default unauthenticated increases the chance of backend misuse, mass registration, or future copy/paste of the pattern into more sensitive calls.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The explicit unsafe default require_auth=False for key creation weakens trust boundaries and normalizes bypass of authentication for a sensitive operation. Even if intended for self-service onboarding, making the default unauthenticated increases the chance of backend misuse, mass registration, or future copy/paste of the pattern into more sensitive calls.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Recharge-order creation is a payment-related capability that is not justified by the declared search/enrichment purpose. Embedding payment initiation inside the skill creates unnecessary financial-risk surface, including accidental charges, abuse of billing endpoints, and reduced reviewability of what the skill can do.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code can log full API request and response bodies containing contact-search queries and returned personnel data to local log files. Even though logging is currently disabled by default, the feature exists and would create sensitive local artifacts if enabled, which is risky for a skill explicitly handling business-contact enrichment and executive search data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The utility layer persists task metadata and search results to local files under the skill directory, which exceeds the manifest’s visible search/enrichment behavior and can retain sensitive personnel data longer than users expect. In a head-hunting/contact-enrichment context, stored result sets may include personal and business profile data, increasing privacy, compliance, and data-retention risk if the host is shared or compromised.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58