Security audit

LinkedIn 公司员工查询，按公司 ID 从 LinkedIn 数据获取员工名单与职位。帮助招聘人员、销售团队与 B2B线索构建者发掘公司层级、核验团队结构、丰富联系数据——适合人才调研、组织分析与线索资格筛选。

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised LinkedIn employee lookup, but it also handles local API credentials, account recharge flows, diagnostic reporting, and hidden version-check persistence in ways users should review carefully.

Install only if you are comfortable giving the skill an Upkuajing API key, making paid API calls after explicit confirmation, and potentially using recharge and diagnostic-reporting flows. Do not run the documented cat command on the .env file or paste API keys into chat; prefer setting the key through a safer secret mechanism and review any error report before sending it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:38
Finding: Documentation Instructs Users to Print the API Credential File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:61
Finding: API Key File Is Created Without Enforced Private Permissions or Symlink Protection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Third-Party Dependency Is Not Reproducibly or Integrity Pinned
Content: View full analysis
=0.23.0 ``` The documented installation command in `SKILL.md`, line 22, is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The lower-bound-only version constraint permits pip to install any future `httpx` release satisfying the requirement. The dependency file also does not provide artifact hashes or a locked transitive dependency set. No evidence was found that the named package is currently malicious. The risk is that installation behavior is not reproducible: future releases, dependency changes, compromised artifacts, or compatibility-breaking updates can be introduced without a corresponding review of this Skill. Because `httpx` is imported into the shared request layer, compromise or unexpected behavior in the installed dependency could affect API credentials, request contents, and response data processed by the Skill. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` instruction. 2. The package resolver selects the newest release satisfying `httpx>=0.23.0` and resolves its current transitive dependencies. 3. A future compromised, malicious, or behaviorally incompatible artifact is downloaded because no exact version or expected hash is enforced. 4. The artifact executes during installation or when imported by the scripts. 5. Malicious dependency code runs with the same local privileges as the user and may access process data, environment variables, files available to that user, or network traffic handled by the Skill. This path is conditional on an upstream or package-distribution compromise; the audit found no embedded malicious dependency in the project itself. ### Impact Assessment A compromised dependency would execute with the privileges of the user installi ...[truncated 356 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding that the skill performs unrelated remote version checks and local metadata/cache writes suggests additional side effects beyond its stated purpose. Even if low severity by themselves, undeclared network and file side effects reduce transparency and can create policy bypass opportunities in environments expecting a simple data-query skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding that the skill performs unrelated remote version checks and local metadata/cache writes suggests additional side effects beyond its stated purpose. Even if low severity by themselves, undeclared network and file side effects reduce transparency and can create policy bypass opportunities in environments expecting a simple data-query skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding that the skill performs unrelated remote version checks and local metadata/cache writes suggests additional side effects beyond its stated purpose. Even if low severity by themselves, undeclared network and file side effects reduce transparency and can create policy bypass opportunities in environments expecting a simple data-query skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The finding that the skill performs unrelated remote version checks and local metadata/cache writes suggests additional side effects beyond its stated purpose. Even if low severity by themselves, undeclared network and file side effects reduce transparency and can create policy bypass opportunities in environments expecting a simple data-query skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding that the skill performs unrelated remote version checks and local metadata/cache writes suggests additional side effects beyond its stated purpose. Even if low severity by themselves, undeclared network and file side effects reduce transparency and can create policy bypass opportunities in environments expecting a simple data-query skill.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly instructs reading ~/.upkuajing/.env and shows the API key format, creating a strong risk that the agent will display or otherwise exfiltrate the secret to the conversation. In skill context this is especially dangerous because the file is a local credential store unrelated to the user-visible result; exposing it compromises the third-party account and can enable unauthorized API usage and billing.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The skill directs access to a .env file that stores an API key, which is a classic credential-access pattern. In an agent setting, reading such a file can leak the secret into model context, logs, tool outputs, or user responses, enabling account compromise and unauthorized paid API consumption.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The instructions tell the agent to inspect the local .env for the API key and potentially participate in populating it, expanding the agent's access to local credential material. This is risky because it normalizes secret-file handling inside a general-purpose skill and may lead to accidental disclosure or unsafe persistence of credentials.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
### **未设置API密钥** 请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择；

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Automatically applying for a new API key and saving it to ~/.upkuajing/.env introduces credential creation and persistence side effects far beyond a read-only employee lookup workflow. If exploited or mis-executed, it can create unmanaged secrets on disk, expand account surface area, and make later leakage more likely.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY; 如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择： 1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件) 2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env 等待用户选择； ### **账户充值**

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements authentication lifecycle and billing-related functions (API key issuance, account info, recharge orders, pricing) that are unrelated to the declared LinkedIn employee analysis skill. Such scope expansion is dangerous because it grants the skill extra capabilities involving credentials and payments, increasing attack surface and enabling misuse beyond user expectations.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.
python
""" 申请新的 API 密钥。 """ # 检查是否已存在 .env 文件和 API key env_file = UPKUAJING_ENV_FILE if env_file.exists():

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The code writes a newly issued API key in plaintext to a .env file under the user's home directory. Plaintext secret storage is dangerous because other local processes, backups, logs, or misconfigured permissions may expose the credential and allow unauthorized API use.
Content: Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.
python
"envFilePath": str(env_file) } # 保存到 .env 文件 try: with open(env_file, 'w', encoding='utf-8') as f: f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

Category: Privilege Escalation
Confidence: 72% confidence
Finding: On write failure, the code instructs the user to manually set the API key as an environment variable, which can encourage insecure handling of secrets through shell history, process listings, or ad hoc configuration. This is weaker than secure secret management and may lead to accidental exposure.
Content: Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.
python
except IOError as e: return { "success": False, "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。", "envFilePath": str(env_file) }

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The ability to create recharge/payment orders has no direct relation to LinkedIn company employee discovery and introduces financial-operation capability into a data-analysis skill. If invoked unexpectedly or abused by another component, it could trigger unauthorized payment workflows or social-engineering style redirection to payment URLs.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.
python
API_BASE_URL = "https://openapi.upkuajing.com" API_KEY_ENV = "UPKUAJING_API_KEY" UPKUAJING_DIR = Path.home() / '.upkuajing' UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env' UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs' # 日志开关

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for retrieving LinkedIn company page data, employee lists, and organizational insights. This file instead implements platform error reporting by collecting request metadata and sending it to '/agent/skill/error/report', which is operational telemetry rather than LinkedIn company/employee analysis behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares no explicit tool scope even though its documented behavior requires environment access, local file reads/writes, and network calls. This weakens sandboxing and reviewability: a skill that can read credentials from local files and contact external services should declare those capabilities up front so operators can constrain or deny them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description is entirely in Chinese and presents the skill as Chinese-only, with no indication that users may interact in another language or choose their preferred locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill's operational scope expands from employee lookup into API key lifecycle management, recharge/order flows, and exception reporting. Bundling these functions together increases the attack surface and can pressure the agent into handling secrets, payments, and outbound reporting in contexts where the user only requested data retrieval.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Recharge order creation and returning a payment URL are materially different from querying employee data and introduce financial action risk. If misused, the skill could initiate unintended purchases or steer users to external payment flows they did not expect from a data lookup tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document explicitly instructs agents to upload request parameters, response payloads, and exception context to a central error-reporting API. Even if the platform claims sensitive fields are 'automatically desensitized,' this is not a sufficient security control by itself because stack traces, raw inputs, and upstream responses commonly contain personal data, access tokens, internal identifiers, or business-sensitive content. In this skill’s context—enumerating company employees and business contacts from LinkedIn data—the likelihood of handling personal or sensitive profiling data makes such telemetry more privacy-sensitive, not less.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/common.py:196

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Ssd 3

Credential Access

API密钥与充值

Credential Access

Credential Access

Description-Behavior Mismatch

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Context-Inappropriate Capability

Credential Access

Description-Behavior Mismatch

Undeclared Tool Scope

Natural-Language Policy Violations

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Static analysis

File appears to expose a hardcoded API secret or token.