LinkedIn 公司员工查询，按公司 ID 从 LinkedIn 数据获取员工名单与职位。帮助招聘人员、销售团队与 B2B线索构建者发掘公司层级、核验团队结构、丰富联系数据——适合人才调研、组织分析与线索资格筛选。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.3

Overview

This paid LinkedIn employee lookup skill is mostly coherent and disclosed, but users should understand its API-key storage, billing, telemetry, and version-check behavior before installing.

Install only if you are comfortable using Upkuajing's paid API. Expect the skill to read or create ~/.upkuajing/.env for UPKUAJING_API_KEY, make network calls to Upkuajing, and deduct balance for confirmed lookup requests. Review any error report before approving it, and avoid including secrets or sensitive business data in report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises code-capable behavior involving environment access, local file reads/writes, and network operations, but does not declare corresponding permissions. This weakens transparency and consent boundaries, making it harder for users or a host platform to understand that the skill can inspect local secrets, modify configuration, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is employee lookup, but the documented behavior also includes API key issuance, local credential persistence, account/balance queries, recharge order creation, pricing queries, error reporting, and version-check network activity. This expansion of scope increases the attack surface and creates opportunities for unexpected billing, credential handling, and data exfiltration beyond what a user would reasonably expect from a lookup skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script sends skill identifiers, request metadata, and free-form context to an external endpoint for operational telemetry, but this behavior is not aligned with the stated LinkedIn analysis purpose of the skill. Because the context field may contain exception details, request paths, or other runtime data, it can leak sensitive information to a platform service without clear minimization or purpose limitation.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This module writes a version-check cache under the user's home directory, which is unrelated to the stated LinkedIn data collection purpose of the skill. While the write itself is limited and not overtly malicious, it introduces undeclared local state and persistence behavior that expands the skill's capabilities beyond user-expected functionality.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill performs outbound network communication to a version API that is not necessary for LinkedIn company/employee analysis. Even though only the skill name is sent, unsolicited network egress creates a privacy and supply-chain risk surface, especially if the API base URL is externally controlled or if the check occurs automatically during normal use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The API documentation explicitly allows uploading request parameters, response payloads, and error context to a central error-report endpoint, but it does not clearly warn operators about the risk of including secrets, personal data, or business-sensitive content. Although it mentions that sensitive fields are 'automatically desensitized', that assurance is vague and may cause overcollection or accidental disclosure if masking is incomplete or misconfigured.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The network submission sends request/context data to a remote API without any visible notice, consent flow, or sanitization in this file. If upstream callers place stack traces, request payloads, tokens, or customer data into context, the script will forward them externally, creating a confidentiality and compliance risk.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The code sends the skill name to a remote service without any visible user-facing disclosure or consent in this file. Although the transmitted data is limited, the undisclosed telemetry behavior weakens transparency and can contribute to privacy concerns and hidden environment fingerprinting.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs reading ~/.upkuajing/.env to check for API keys and supports automatically applying for and writing a new key into that local secrets file. Accessing and modifying credential stores is sensitive because it exposes secrets-handling behavior and could overwrite, disclose, or misuse credentials if the skill or surrounding automation is compromised or overly permissive.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: This line continues the credential-handling workflow by directing checks of ~/.upkuajing/.env and enabling automated API key creation and storage. In the context of a data lookup skill, local secret-file interaction is more dangerous because it exceeds the minimum needed for the declared function and creates opportunities for secret exposure and unauthorized account usage.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: The script writes a newly issued API key in plaintext to a .env file under the user's home configuration directory. Plaintext secret storage increases the chance of credential disclosure through weak file permissions, backups, accidental commits, local malware, or multi-user system access; in the context of a skill unrelated to authentication, bundling billing/auth logic makes this more sensitive because users may not expect secret persistence.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including releases with breaking changes or newly introduced supply-chain risk. While this is common and not inherently malicious, it reduces build reproducibility and can expose the skill to unexpected vulnerable or incompatible versions over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196