支持海外公司股东查询 、高管查询、股权结构穿透，按公司ID从全球企业数据库获取含持股比例、股份类型与股东层级的股东名单。帮助投资者、分析师、业务销售人员、风控研究股权结构、实际控制人穿透/最终受益人——适合尽职调查、投资研究、竞品与集团关系分析、关联交易排查，常用于判断目标公司控制人与公司资本实力

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.4

Overview

The skill performs a paid shareholder lookup, but it also stores API credentials locally, includes account recharge flows, and performs an undisclosed version-check request with local cache writes.

Review this before installing if you are uncomfortable with a skill storing an API key in ~/.upkuajing/.env, creating recharge payment orders, querying account balances, or making provider version-check requests. Use it only with an API account you intend to spend from, and avoid sending sensitive request or response details in error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its documentation clearly instructs access to environment variables, local files under ~/.upkuajing/.env, network APIs, and local file writes. This mismatch is dangerous because it prevents proper user/platform review of the skill's effective capabilities and can lead to execution with more sensitive access than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is shareholder/beneficial-owner lookup, but the documented behavior also includes API key issuance, writing credentials to disk, account/balance inspection, recharge order creation, pricing queries, remote error reporting, and version/cache operations. This expansion of scope is risky because users may authorize a data-query skill without realizing it can alter local credentials, initiate paid workflows, and send metadata to external services.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation embeds account management, key application, recharge, pricing, and error-reporting flows that are outside the advertised shareholder-query scope. This is dangerous because it normalizes privileged and billable side effects inside a data-retrieval skill, increasing the chance of unintended credential changes, paid actions, or external data disclosure.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements API key issuance, account inspection, and recharge/payment operations even though the skill is ներկայացց as a shareholder/beneficial-owner lookup tool. This mismatch expands the skill's capability into credential and billing management, increasing the attack surface and making hidden monetization or unauthorized account actions easier to smuggle into an otherwise data-query-focused integration.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The script can create recharge orders, which is a financially sensitive action unrelated to the stated purpose of querying shareholder information. In the context of an agent skill, hidden payment initiation capabilities are dangerous because they can trigger unauthorized billing flows or socially engineer users into funding a third-party platform.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Account balance and platform pricing queries expose billing and account-management functionality beyond the reasonable scope of a shareholder information lookup skill. While less severe than payment creation, they still reveal sensitive operational/account context and suggest the skill has broader privileged access than users would expect from its description.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This module adds behavior outside the skill’s declared shareholder-information purpose by making a remote version-check request and writing persistent local state under the user’s home directory. While the transmitted data is limited to the skill name and the functionality appears operational rather than overtly malicious, it still introduces hidden network egress and filesystem side effects that can surprise users, expand attack surface, and create privacy/governance concerns in restricted environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The API reference explicitly allows reporting `requestParams`, `responseData`, and `context`, but it does not clearly warn users that these fields can contain sensitive business data, identifiers, or internal error details. In this skill’s context—enterprise/shareholder investigations and beneficial-owner analysis—those payloads may include confidential corporate intelligence or user-submitted data, so sending them to a central error-report endpoint can create unintended data exposure and over-collection risks.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code sends the skill name to an external API without any user-facing disclosure or consent mechanism in this file. Even though the payload is small and not obviously sensitive, undisclosed outbound communication is a security and privacy concern because it can reveal installed capabilities, support fingerprinting, and violate expectations in locked-down or compliance-sensitive deployments.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs checking for a credential in ~/.upkuajing/.env and supports obtaining a new API key and automatically saving it to that file. Accessing and modifying local credential stores is sensitive because it exposes secrets to the skill runtime and creates persistence that could be abused for unauthorized future API use or credential leakage.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: The documented flow again directs inspection of ~/.upkuajing/.env and allows automatic persistence of a newly issued API key. Repeated credential-file access and write instructions increase the chance of secret exposure, accidental overwrite, or unauthorized long-term storage of sensitive tokens on the host.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 84% confidence
• Finding: The script writes a newly issued API key to a plaintext .env file in the user's home area without any visible permission hardening. In an agent-skill context, storing credentials unencrypted in a predictable location can expose them to other local processes, accidental backups, or misconfigured file sharing, leading to unauthorized API use.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency specification uses a lower-bound only version constraint (httpx>=0.23.0), which allows installation of any newer release, including future major versions with breaking changes or newly introduced supply-chain risk. While this is not an immediate exploit by itself, it weakens build reproducibility and can expose the skill to unexpected vulnerable or incompatible dependency versions over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196