Security audit

支持海外公司股东查询、高管查询、股权结构穿透，按公司ID从全球企业数据库获取含持股比例、股份类型与股东层级的股东名单。帮助投资者、分析师、业务销售人员、风控研究股权结构、实际控制人穿透/最终受益人——适合尽职调查、投资研究、竞品与集团关系分析、关联交易排查，常用于判断目标公司控制人与公司资本实力

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate paid company-shareholder lookup tool, but it handles API credentials in ways that can expose or persist secrets unsafely.

Review before installing. Use this skill only if you trust the Upkuajing service and are comfortable with paid API calls. Do not run commands that print `~/.upkuajing/.env`; configure the key through a safer secret mechanism or verify only that it exists. If using file storage, restrict `~/.upkuajing` and `.env` to owner-only permissions, and explicitly confirm any billable query, key creation, recharge-order creation, or error report.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:38
Finding: API Key Exposure Through Credential File Display Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:67
Finding: Credential File Created Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unbounded and Unpinned Third-Party HTTP Dependency
Content: View full analysis
=0.23.0 ``` The installation workflow in `SKILL.md:23` instructs users to run: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency specification permits any `httpx` release at or above version `0.23.0`, including future major or otherwise incompatible versions. No lock file, upper compatibility bound, or package hash is supplied. Consequently, two installations performed at different times may resolve to different code. If a future release, transitive dependency, package-index response, or distribution artifact is compromised, that code may be installed and later imported with the same privileges as the Skill. The lack of hashes also prevents the installer from validating that it received a specifically reviewed artifact. The package name matches the library imported by the source code, and the audit found no evidence of typosquatting or an intentionally malicious package. The finding concerns unsafe dependency controls rather than proof that the current `httpx` package is malicious. ### Attack Path 1. An Agent or user follows the documented environment setup procedure. 2. `pip install -r requirements.txt` resolves the newest release satisfying `httpx>=0.23.0`. 3. The installer retrieves an artifact that was not fixed or integrity-approved during Skill review. 4. A compromised package artifact, compromised transitive dependency, or unsafe future release is installed. 5. The package executes installation behavior or is imported when the Skill runs. 6. The dependency receives the process privileges available to the Skill, including access to the API key when the application constructs authenticated requests. This path depends on a compromised or unsafe dependency artifact or package distribution channel; no s ...[truncated 570 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is shareholder and beneficial-owner lookup, but the skill also includes API key issuance, local secret storage, account information access, recharge order creation, and pricing queries. This expands the trust boundary far beyond the advertised business function, increasing the chance of unexpected charges, credential handling, and privileged account actions under a misleading description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is shareholder and beneficial-owner lookup, but the skill also includes API key issuance, local secret storage, account information access, recharge order creation, and pricing queries. This expands the trust boundary far beyond the advertised business function, increasing the chance of unexpected charges, credential handling, and privileged account actions under a misleading description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose is shareholder and beneficial-owner lookup, but the skill also includes API key issuance, local secret storage, account information access, recharge order creation, and pricing queries. This expands the trust boundary far beyond the advertised business function, increasing the chance of unexpected charges, credential handling, and privileged account actions under a misleading description.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to display the contents of ~/.upkuajing/.env with cat, which can reveal the API key in plaintext. Exposing secrets in chat or logs enables credential theft, unauthorized API use, account abuse, and downstream billing or data-access compromise.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: This finding is a true credential-access issue because the skill directs access to a local .env file storing UPKUAJING_API_KEY. Accessing secret material from a home-directory file materially increases the risk of disclosure through agent output, logs, or misuse by other instructions.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill instructs checking a local secret file for the API key and then potentially initiating key-management flows. Even if the intent is setup assistance, combining local secret inspection with credential lifecycle actions broadens exposure and can lead to accidental disclosure or unauthorized provisioning.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
### **未设置API密钥** 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择；

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The instruction to apply for a new API key and automatically save it into ~/.upkuajing/.env introduces credential creation and local persistence in a skill that is presented as a data-query tool. That increases the blast radius if the environment is compromised and creates opportunities for silent credential issuance or misuse if user consent boundaries are unclear.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 72% confidence
Finding: The code writes a newly issued API key into a plaintext .env file under the user’s home/application directory without setting restrictive permissions. If the file is readable by other local users, included in backups, or accidentally exposed, the API key can be stolen and used to access the associated account or consume paid API balance.
Content: Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.
python
"envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.
python
API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares capabilities that imply reading secrets, writing local files, and making network requests, but it does not explicitly constrain or disclose tool scope via permissions or allowed-tools. This weakens least-privilege boundaries and makes it harder to reason about or enforce what the skill is allowed to do, especially because the skill also references credential files and external API operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill description and all operational instructions are written entirely in Chinese, and the skill name is suffixed with 'zh', indicating a fixed language/locale behavior. There is no statement offering the user a language choice or documenting that the language restriction is required for a specific compliance or regional context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The API documentation explicitly encourages sending request parameters, response payloads, and exception context to a central error-reporting endpoint. Even though it says sensitive fields will be automatically masked, it does not define the masking scope or require callers to minimize data before submission, creating a real risk of leaking personal, commercial, or authentication-related data through logs and diagnostics. In this skill’s context, the system handles corporate ownership and beneficial-owner information, so exception traces and payloads may contain sensitive investigative or regulated data, making the telemetry channel more dangerous.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring and user-facing descriptions are written entirely in Chinese, and the CLI help/messages continue this pattern throughout the file. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.
python
pass # 如果读取失败，继续执行 # 不需要认证申请新密钥 response = make_request('/agent/auth/create', {}, require_auth=False) # 检查是否申请成功 if response.get('code') != 0:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code file contains natural-language documentation and operational messages entirely in Chinese, starting with the module docstring and continuing throughout user-visible output. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 技能描述聚焦于调取企业资料库、查询股东和实际受益所有人并梳理股权关系，但这一段代码额外实现了任务ID生成、任务目录管理、元数据保存和结果追加写入等本地持久化能力。虽然辅助缓存并非一定异常，但清单并未表明该技能会在本地创建和维护任务数据，因此行为范围明显宽于所宣称的查询分析功能。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file docstring and implementation show that it reports invocation exceptions via '/agent/skill/error/report' and handles report IDs, rather than querying enterprise/shareholder/beneficial-owner data or analyzing ownership structures. This is a semantic mismatch between the skill's advertised function and actual implemented behavior in this file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for querying global company shareholder information, beneficial owners, and ownership/investment relationships. This file instead collects runtime error context and sends it to a platform error-reporting endpoint, which is an operational telemetry capability rather than a direct requirement of the stated business purpose.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Ssd 3

Credential Access

API密钥与充值

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Unsafe Defaults

Unsafe Defaults

Natural-Language Policy Violations

Description-Behavior Mismatch

Description-Behavior Mismatch

Context-Inappropriate Capability