Pinpointing global corporate personnel, locating individuals from global corporatedatabases by name, company, industry, and profile URL. Helping recruiters, sales teams,and B2B lead-generation specialists discover global contacts, source candidates, andenrich contact data—suitable for talent search, headhunting, lead development, andcross-border customer acquisition.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:35 AM UTC
• Version: 1.0.3

Overview

The skill appears to be a legitimate people-search integration, but it deserves review because it handles sensitive contact/profile data and persists credentials and results with limited safeguards.

Review this skill before installing in environments with sensitive recruiting, sales, or customer data. Use a dedicated low-privilege API key, check file permissions on ~/.upkuajing/.env, avoid sending personal data in error reports, and periodically delete task_data result files you no longer need.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill exercises sensitive capabilities—reading environment state, reading and writing files under the user's home directory, and making network requests—without declaring corresponding permissions. That undermines informed consent and platform policy enforcement, because users invoking a seemingly simple search skill may not realize it can persist credentials, store output locally, or contact remote services beyond the core search API.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is people search and enrichment, but the skill also performs account lifecycle actions, pricing retrieval, payment-order creation, remote error reporting, version checks, and local persistence. This mismatch is dangerous because it expands trust and attack surface: a user may authorize a lookup tool without understanding it can modify local credential files, initiate billing-related workflows, or exfiltrate execution context to the vendor platform.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The module persists task metadata and search results to local files under a task_data directory, which creates a durable local store of personnel lookup data beyond transient request handling. In the context of contact enrichment and head-hunting, that data can include sensitive personal/business information, increasing privacy, retention, and unauthorized-access risk if the host is shared or compromised.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The code performs a version-check/update notification network call on each request path via check_and_notify(API_BASE_URL), which is unrelated to the core personnel search action. Even if not overtly malicious, this introduces an extra network side effect, metadata leakage, and supply-chain/tracking risk because execution now depends on additional remote behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly supports searching and filtering individuals by contactability and demographic/profile attributes, including phone, email, WhatsApp, social presence, country, and gender, but provides no privacy, lawful-basis, or acceptable-use guardrails. In a head-hunting and overseas sales-lead enrichment context, this materially increases the risk of privacy violations, unlawful profiling, and misuse for spam, harassment, or discriminatory targeting.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs agents to send request parameters, response data, and error context to an external reporting endpoint, and even notes stack traces/error details for diagnosis, but does not require user notice, consent, minimization, or explicit exclusion of sensitive personal data. In this skill's context—personnel search, contact enrichment, head-hunting, and overseas lead development—the payloads are especially likely to contain personal or business contact data, making unintended data disclosure to the platform-side reporting API a realistic privacy and compliance risk.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 93% confidence
• Finding: The skill instructs the agent to inspect and populate `~/.upkuajing/.env` for `UPKUAJING_API_KEY`, which is direct credential access and persistence in a local file. In this context, that is risky because a search skill should not silently read or write secret material; compromise of the skill or misuse of its capabilities could expose API keys, overwrite existing secrets, or normalize unsafe secret-handling practices.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 93% confidence
• Finding: This section explicitly directs checking `~/.upkuajing/.env` and automatically saving a newly applied API key there, combining credential discovery with credential persistence. That increases the blast radius of any agent misuse: secrets may be harvested from disk, replaced, or left in a less-protected plaintext location, and users may not appreciate that invoking the skill changes local secret state.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: The code writes a newly issued API key to a plaintext .env file without any visible permission hardening or secure-storage control. If the home directory, file permissions, backups, or local multi-user environment are not properly secured, the credential can be exposed and reused to access the paid external API or associated account resources.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound only (httpx>=0.23.0), which allows installation of any future major or minor release. That can introduce unreviewed breaking changes or newly introduced supply-chain risk into the skill at install time, reducing reproducibility and making security posture unpredictable.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58