Retrieving LinkedIn company employee queries, fetching employee lists and job titles fromLinkedIn data by company ID. Helping recruiters, sales teams, andB2B lead-generationspecialists discover corporate hierarchies, verify team structures, and enrich contactdata—suitable for talent mapping, organizational analysis, and lead qualification.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:52 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed paid UpKuaJing API integration for LinkedIn employee lookup, with sensitive credential and billing support that users should handle carefully.

Install only if you are comfortable using UpKuaJing as the paid data provider. Keep the API key in ~/.upkuajing/.env protected, do not share command output that may reveal it, confirm every fee-incurring lookup before running it, and review any error report text before allowing it to be sent.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill uses environment variables, reads and writes local files under the user's home directory, and makes network requests, but it does not declare corresponding permissions. This undermines informed consent and platform enforcement because the actual capability surface is broader than what a user or runtime policy would expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is employee lookup, but the skill also handles credential creation/storage, account balance retrieval, recharge order creation, pricing queries, error reporting, and version-related persistence. This functional expansion increases the attack surface and can surprise users with credential handling, billing, and external reporting behaviors not implied by the description.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements authentication, API-key provisioning, account-balance lookup, and billing actions for a third-party platform ('跨境魔方'), which does not align with the declared LinkedIn employee lookup purpose. This mismatch is dangerous because users or calling agents may unknowingly trigger unrelated account-management capabilities, expanding the skill's privileges and enabling hidden external service interactions.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The CLI exposes recharge-order creation and account/pricing retrieval functions unrelated to LinkedIn employee lookup. In a skill presented as research or lead-generation tooling, hidden financial/account operations create a significant trust and abuse risk because an agent or user may invoke capabilities that affect billing or reveal account data without expecting them.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The utility module is explicitly wired to an unrelated third-party service ('跨境魔方' / upkuajing.com) rather than the declared LinkedIn employee lookup purpose. This mismatch strongly suggests hidden data redirection: user queries, identifiers, or results intended for LinkedIn research could be sent to an undeclared external API, violating user expectations and creating a covert exfiltration path.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code retrieves credentials from both process environment variables and a home-directory .env file for an undeclared third-party API. Even though it only accesses a specific key rather than harvesting all environment data, this still expands secret access beyond the stated skill purpose and can silently bind the skill to local operator credentials.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The optional logging functions persist request parameters and full response bodies to local log files. If enabled, this can store user queries, company identifiers, API outputs, and potentially sensitive business research data in plaintext on disk, increasing exposure through local compromise, backups, or accidental sharing.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script sends exception data to '/agent/skill/error/report', including request metadata and free-form context, even though that telemetry is not justified by the visible LinkedIn research functionality. In a skill handling business research workflows, error context can easily include user prompts, company identifiers, internal notes, or API data, creating an unnecessary data-exfiltration path to the platform.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This module performs outbound network communication to a version-check endpoint and writes local cache state even though the advertised skill functionality is LinkedIn employee lookup and hierarchy analysis. That mismatch creates an undocumented telemetry/update-check channel which increases the attack surface, can leak installation/usage metadata, and violates least surprise for users of a data-retrieval skill.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file's behavior is inconsistent with the declared purpose of the skill: instead of LinkedIn company/employee processing, it extracts local metadata, contacts a remote API, and persists local state. Such hidden or unrelated behavior is dangerous because users and reviewers may not expect background communications and filesystem writes in this context, making abuse or covert telemetry harder to detect.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase 'B2B lead qualification' is much broader than the concrete function of listing LinkedIn employees by company ID. This can route generic sales-assistance prompts into a skill that performs paid API operations and handles account state, creating unintended data access and spend risks.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase 'B2B lead qualification' is much broader than the concrete function of listing LinkedIn employees by company ID. This can route generic sales-assistance prompts into a skill that performs paid API operations and handles account state, creating unintended data access and spend risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code transmits 'requestId', 'requestPath', and especially 'context' to a remote endpoint without any visible disclosure, consent, or filtering. Because 'context' is caller-controlled and likely to contain detailed failure data, this can leak sensitive business information or personal data during normal error handling, making accidental exfiltration plausible.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 96% confidence
• Finding: The skill instructs the agent to inspect `~/.upkuajing/.env` for `UPKUAJING_API_KEY` and to manage credentials through a local plaintext file. Accessing or modifying credential stores is sensitive because it exposes secrets, expands persistence on the host, and may enable unauthorized reuse of the API key by other processes or future sessions.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 97% confidence
• Finding: The skill goes further by directing automatic creation of a new API key and saving it to `~/.upkuajing/.env`, creating persistent local secret storage outside a managed vault. Persistent plaintext credential storage combined with networked account-management actions materially raises the risk of secret leakage, account abuse, and unintended billing.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 91% confidence
• Finding: The code reads the existing .env file and then includes the first 10 characters of any existing API key in a returned message. Exposing even partial secret material increases the chance of credential leakage through logs, terminal history, screenshots, or downstream agent outputs.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: The code writes the newly issued API key directly to a .env file without any visible permission hardening or use of a secure secret store. On multi-user systems or misconfigured environments, plaintext secret storage can expose credentials to other local users, backup systems, or tooling that scans project files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower-bound range (`httpx>=0.23.0`) rather than an exact version, which makes builds non-reproducible and can silently pull in newer releases with breaking changes or newly introduced supply-chain risk. In a skill that performs external network access to LinkedIn-related targets, dependency drift increases the chance that a compromised or vulnerable upstream release is introduced without review.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60