全球公司搜索，按名称、行业、产品与 URL 从全球公司数据库找公司。帮助出口商、销售团队与 B2B线索构建者发掘全球公司、研究目标市场、丰富企业画像数据——适合客户开发、市场调研、供应商寻源与跨国线索生成。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:36 AM UTC
• Version: 1.0.3

Overview

The skill's company-search purpose is mostly coherent, but it stores a paid API key in plaintext and includes under-disclosed remote version and reporting behavior that users should review before installing.

Install only if you are comfortable with a paid Upkuajing API key being stored in plaintext at ~/.upkuajing/.env and with the skill contacting Upkuajing for searches, account actions, version checks, and user-approved error reports. Avoid sending raw secrets, personal data, or full payload dumps in error reports, and use any returned contact data only where you have a lawful and appropriate basis.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit permissions, yet its instructions clearly require reading environment variables, reading and writing files under the user's home directory, and making networked API calls. This mismatch weakens transparency and sandbox/policy enforcement, increasing the chance that users or orchestration systems allow broader capabilities than they intended.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module performs outbound network communication to a remote API and writes persistent state under the user's home directory, behavior that is unrelated to the stated company-search function of the skill. Even though the transmitted data appears limited to the skill name and version state, the hidden side effect expands the trust boundary, creates telemetry/persistence, and could be abused for tracking or as a foothold for future update-related behaviors.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file implements self-version tracking and update notification logic that is outside the business purpose described for the skill. This kind of undeclared lifecycle-management capability is risky because it normalizes remote contact and local persistence in a component that users would expect to only perform company-search tasks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The API documentation explicitly exposes filters and result fields for employee or core-member contact availability, including `existPersonContact` and `person_contact_show`, without any privacy, consent, or acceptable-use warning. In a lead-generation and supplier discovery skill, this increases the risk of misuse for scraping, unsolicited outreach, or collection of personal contact data at scale.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs agents to send error context, request parameters, and response data to a remote reporting API, which can expose operational or user data if those fields contain sensitive information. Although it mentions automatic masking of sensitive fields, it does not clearly define what is masked, obtain user/operator consent, or require minimization before transmission, so privacy-sensitive data could still be disclosed during troubleshooting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script automatically writes a newly issued API key to a local .env file without an explicit confirmation step or warning before persistence. Storing credentials in plaintext on disk can expose them to other local users, backups, logs, or accidental inclusion in source control, especially in agent environments where users may not expect credential material to be written.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: `report_error` forwards caller-supplied `context` and request metadata to `/agent/skill/error/report` without any sanitization, minimization, or consent checks in this file. If `context` contains prompts, user data, credentials, tokens, or internal system details from failures, the skill may exfiltrate sensitive information to the platform unnecessarily.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The version check sends skill metadata to a remote endpoint without any user-facing disclosure or confirmation in this file. Silent telemetry, even if minimal, is a privacy and trust issue because it reveals installed skill usage/context and establishes an undisclosed external communication path.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 88% confidence
• Finding: The skill instructs the agent to inspect a secrets file in the user's home directory to determine whether an API key is present. Encouraging an automated agent to access credential storage increases the risk of secret exposure, unintended disclosure in logs or responses, and overbroad file access beyond the minimum needed for task execution.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 86% confidence
• Finding: The skill further directs storing newly created API keys automatically into ~/.upkuajing/.env, which normalizes writing secrets to a plain-text file through agent actions. This expands the secret-handling surface and can lead to credential persistence in insecure locations, accidental overwrite, or later leakage through file reads, backups, or debugging output.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 96% confidence
• Finding: This line writes the API key directly into a plaintext .env file, creating a local secret-exposure risk. In the context of an agent skill, this is more concerning because users may invoke the skill for business search functionality and not expect it to persist sensitive credentials to disk in a developer-oriented format.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 96% confidence
• Finding: The dependency specifier `httpx>=0.23.0` is unpinned, allowing installation of any newer version, including major releases with breaking changes or a compromised upstream release. This weakens build reproducibility and increases supply-chain risk because different environments may resolve to different package versions over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196