Identifying global companies, locating businesses from global corporate databases by name,industry, product, and URL. Helping exporters, sales teams, and B2B lead-generationspecialists discover global companies, research target markets, and enrich firmographicdata—suitable for customer acquisition, market research, supplier sourcing, andcross-border lead generation.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:45 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a disclosed paid company-search integration, but it stores API keys locally and performs an automatic version-check network call with local persistence that users may not expect.

Review before installing if you are uncomfortable with a paid lead-generation tool storing its service API key in a plaintext home-directory file, returning company/contact data, creating top-up payment links, or silently contacting the provider for daily version checks. Use a dedicated API key, confirm costs before searches, avoid sending sensitive request/response details in error reports, and check local permissions on ~/.upkuajing/.env.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no explicit permissions while its documented behavior includes reading environment variables, reading and writing local credential files, and making network requests. This weakens user and platform visibility into what the skill can access and do, increasing the chance of unintended credential exposure or silent side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a company-search tool, but its instructions also cover credential provisioning and storage, account and balance retrieval, recharge/payment flows, pricing lookup, error reporting, and version-check traffic. This mismatch can mislead users and reviewers about the true operational scope, causing them to authorize broader access and network activity than expected.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements API-key provisioning, account lookup, recharge-order creation, and pricing retrieval, which materially exceed the declared purpose of a company-search and firmographic-enrichment skill. In an agent setting, hidden auth and billing capabilities expand the trust boundary and could enable unauthorized account actions, billing abuse, or stealthy onboarding to an external service unrelated to the user’s expected task.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Creating recharge/payment orders is a sensitive billing action unrelated to searching companies. If exposed through an agent skill, it can be triggered unexpectedly or abused to initiate financial workflows, which is especially risky because users would not expect payment behavior from a search-oriented integration.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Account-management and API-pricing functionality are outside the stated business purpose and expose operational metadata that can aid misuse, social engineering, or unauthorized service consumption. While not directly destructive on their own, they increase attack surface and violate the principle of least functionality for a company-search skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The module persistently writes version-check state under the user's home directory even though the skill's stated purpose is company search and firmographic enrichment. While this is not directly exploitative, it is hidden side-effect behavior outside core functionality and can create undeclared local persistence, which is a security and trust concern for users evaluating what the skill does on disk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This code performs outbound network communication to check for skill versions, which is unrelated to the declared company-search functionality. Even though the payload is limited, any undisclosed external call expands the trust boundary, enables telemetry, and could be repurposed for tracking or command-and-control style behavior if the endpoint or surrounding code is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API documentation explicitly supports filtering for the existence of phone numbers, emails, WhatsApp accounts, valid contact details, and even core member contact information, but provides no privacy, consent, or acceptable-use constraints. In the context of overseas lead generation and supplier sourcing, this materially increases the risk of targeted scraping, profiling, and misuse of personal or quasi-personal contact data at scale.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented response field `person_contact_show` indicates the API may expose an employee's contact information directly, yet the reference includes no warning about sensitivity, retention, access restrictions, or lawful use. Because this skill is intended for lead generation and supplier research, exposing personnel contact details is especially dangerous: it can facilitate spam, phishing, social engineering, and privacy violations against identifiable individuals.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs agents to send request parameters, response payloads, and exception context to an external error-reporting endpoint, but it does not require explicit minimization, user notice, or a strict allowlist of what may be transmitted. Even if the platform claims sensitive fields are automatically masked, stack traces, request parameters, and response bodies often contain business data, identifiers, URLs, or secrets that may not be reliably redacted, creating a real risk of unintended data exfiltration through telemetry.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The request/response logging helpers write full transmitted data structures to disk, including endpoint, request parameters, and entire API responses, with no field-level redaction. If logging is enabled, sensitive firmographic queries, returned business data, or even auth-related values present in payloads could be retained on disk and later exposed to other local users, backup systems, or forensic recovery.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script sends the caller-supplied `context` field to `/agent/skill/error/report` without any visible minimization, redaction, or user disclosure in this file. Because error context can easily contain request data, internal paths, identifiers, stack traces, or user-provided content, this creates a real risk of unintended data exfiltration to a remote platform endpoint during exception handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The module sends the skill name to a remote API without any visible user-facing disclosure or consent in this code path. Even minimal identifiers can support usage tracking, environment correlation, or inventorying installed skills, which is problematic when it occurs silently and outside the primary business purpose of the skill.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs checking and using a plaintext API key stored in ~/.upkuajing/.env and can automatically create and save a new key there. Accessing and persisting credentials in a local file increases the risk of accidental disclosure, over-broad file access, or reuse by other processes, especially since the skill also performs networked operations and billing-related actions.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: The instructions explicitly direct the agent to inspect ~/.upkuajing/.env for UPKUAJING_API_KEY presence and then write a newly issued key there. That behavior constitutes credential access and storage beyond the core search function, and in this context it is more dangerous because the same skill also supports account info, pricing, top-up, and remote reporting actions that could use the credential once obtained.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: Writing a newly issued API key directly into a plaintext .env file creates a local secret-exposure risk. On multi-user systems, shared environments, backups, or developer tooling, plaintext keys may be harvested and then used to query account info, pricing, or consume billable API resources.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any newer version, including future releases that may introduce breaking changes or a compromised/transitively vulnerable version. In a skill that performs external company lookup and firmographic enrichment, network-facing behavior depends directly on this HTTP client, so unpinned versions reduce build reproducibility and increase supply-chain risk.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The explicit `require_auth=False` setting weakens security posture by making credential provisioning available without prior auth context. Even if intended for onboarding, it broadens abuse potential and violates least privilege when embedded in a non-auth, non-admin skill.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 84% confidence
• Finding: The explicit `require_auth=False` setting weakens security posture by making credential provisioning available without prior auth context. Even if intended for onboarding, it broadens abuse potential and violates least privilege when embedded in a non-auth, non-admin skill.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58