Retrieving LinkedIn company employee queries, fetching employee lists and job titles fromLinkedIn data by company ID. Helping recruiters, sales teams, andB2B lead-generationspecialists discover corporate hierarchies, verify team structures, and enrich contactdata—suitable for talent mapping, organizational analysis, and lead qualification.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its LinkedIn employee lookup purpose, but it handles API keys and paid account actions in ways users should review carefully before installing.

Install only if you trust UpKuaJing with LinkedIn employee lookup requests and understand that API calls may cost money. Do not print the `.env` file contents; store the API key with restrictive permissions or an environment/secret manager, confirm any paid query or top-up action explicitly, and avoid sending sensitive request or response data in error reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:71

Finding

API Key Exposure Through Documentation and Insufficiently Protected Local Storage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-41 and scripts/auth.py:71-74
Vulnerability Type: Plaintext credential exposure and insecure secret-file creation
Risk Level: Medium

Vulnerable Code

SKILL.md:39-41:

markdown

This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

text

`scripts/auth.py:71-74`:

```python
# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

Reading UPKUAJING_API_KEY from a dedicated configuration file is necessary for authenticated API requests. However, displaying the entire file with cat is not necessary. Following this instruction exposes the plaintext API key in terminal output, Agent tool output, conversation transcripts, execution logs, or screen recordings.

The key file is also created with Python's default file-creation behavior. Its permissions therefore depend on the process umask; the code does not explicitly ensure owner-only access. On a system with permissive defaults, another local account may be able to read the credential.

The implementation does not send the key to an unrelated destination. It is used as a Bearer token for the declared HTTPS API. The vulnerability concerns local disclosure and storage rather than confirmed credential exfiltration by the Skill.

Attack Path

1. A user or Agent follows the API-key setup instructions.
2. The command cat ~/.upkuajing/.env prints the complete key.
3. The key is captured by a tool transcript, shell log, terminal recording, or observer.
4. Alternatively, auth.py --new_key creates the file under a permissive umask, allowing another local user to read it.
5. An attacker uses the exposed key to authenticate to the UpKuaJing API.

Impact Assessment

An attacker obtaining the API key could make authenticated AP ...[truncated 311 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to run cat ~/.upkuajing/.env.
2. Check for the variable without exposing its value, for example by parsing the file and returning only whether the key is present.
3. Create ~/.upkuajing with mode 0700.
4. Create the credential file with mode 0600, using os.open with explicit permissions or setting permissions immediately and safely.
5. Write new credentials atomically through a securely created temporary file in the same directory, then replace the destination.
6. Refuse to use a credential file that is owned by another user or is readable by group or other users.
7. Prefer the process environment or an operating-system credential store where supported.
8. Ensure errors and success messages never include any portion of the key.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Creates Supply-Chain and Reproducibility Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unbounded dependency version and missing integrity verification
Risk Level: Low

Vulnerable Code

requirements.txt:1:

text

httpx>=0.23.0

Related installation instruction in SKILL.md:24:

markdown

2. **Install dependencies**: `pip install -r requirements.txt`

Technical Analysis

The lower-bound-only constraint permits the package resolver to install any future httpx version. The project provides neither an upper bound nor a lock file or cryptographic hashes. Consequently, installations are not reproducible and may silently receive behavior-changing or compromised future releases.

This does not establish that the current httpx package is malicious. The confirmed weakness is that dependency selection and integrity are not constrained to a reviewed artifact.

Attack Path

1. A user follows the documented pip install -r requirements.txt instruction.
2. The package resolver selects the newest release satisfying the open-ended constraint.
3. If that release or one of its transitive dependencies is compromised, malicious code can run during installation or when imported.
4. Because the Skill imports httpx for all network operations, compromised runtime code executes with the privileges of the user running the Skill.
5. Such code could access the process environment, the API-key file, query results, and other files available to that user.

Impact Assessment

Exploitation would execute code with the permissions of the installing or invoking user. This could expose UPKUAJING_API_KEY, tamper with API requests and responses, access user-readable files, or modify files writable by that account. The issue does not independently grant administrative privileges unless dependency installation or execution is performed as an administrator.

Remediation

View remediation

Remediation Suggestions

1. Pin httpx to a specifically reviewed version instead of using an unrestricted lower bound.
2. Generate and commit a lock file that includes all transitive dependency versions.
3. Use hash verification, such as pip's --require-hashes, for every resolved package.
4. Review and deliberately update pinned dependencies through a controlled maintenance process.
5. Install dependencies in an isolated virtual environment as a non-administrative user.
6. Use a trusted package index and prevent fallback to untrusted or dependency-confusion-prone sources.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checking and local cache writes are not aligned with the narrowly described LinkedIn employee lookup function. While not inherently malicious, undeclared update checks and filesystem writes expand the skill's operational footprint and can surprise users in restricted environments.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Remote version checking and local cache writes are not aligned with the narrowly described LinkedIn employee lookup function. While not inherently malicious, undeclared update checks and filesystem writes expand the skill's operational footprint and can surprise users in restricted environments.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checking and local cache writes are not aligned with the narrowly described LinkedIn employee lookup function. While not inherently malicious, undeclared update checks and filesystem writes expand the skill's operational footprint and can surprise users in restricted environments.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checking and local cache writes are not aligned with the narrowly described LinkedIn employee lookup function. While not inherently malicious, undeclared update checks and filesystem writes expand the skill's operational footprint and can surprise users in restricted environments.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs reading the full ~/.upkuajing/.env file with cat, which can expose secrets beyond the single required API key and unnecessarily surfaces credential material to the agent or output channel. Direct credential-file reading is sensitive behavior and should be treated as high risk even if intended for setup.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This section directs the workflow to inspect a local credential file and supports adding or automatically storing API keys in ~/.upkuajing/.env. That expands secret-handling responsibilities and creates risk of plaintext credential persistence, unauthorized reuse, or accidental disclosure through logs and support actions.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill again normalizes checking and writing to a local .env file for API key management, reinforcing a pattern of direct credential access and persistence. In a skill that can also perform network calls and optional error reporting, this combination raises the blast radius if the environment is compromised or the skill misbehaves.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements API key provisioning, account lookup, recharge-order creation, and pricing retrieval for a third-party platform, which is materially unrelated to the declared LinkedIn employee/company analysis purpose. That mismatch is dangerous because it expands the skill's authority into credential lifecycle and billing operations, increasing the chance of unauthorized account use, hidden monetization, or supply-chain abuse under a misleading skill description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script manages secrets via a local .env file path and begins by inspecting whether an API key already exists there. Storing long-lived API credentials in plaintext .env files is risky because local disclosure, weak file permissions, backups, or accidental inclusion in logs/repositories can leak credentials.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This code reads the full .env file contents to locate an API key, meaning sensitive material is handled in plaintext in application memory and potentially subject to accidental exposure through debugging or future code changes. In a skill already unrelated to credential management for its advertised purpose, this increases unnecessary secret-handling risk.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script writes a newly issued API key directly into a .env file in plaintext. This is dangerous because compromise of the local filesystem, permissive file permissions, backups, or developer mistakes can expose an active credential that grants access to the associated platform account.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The error path references manual environment-variable setup after a failed .env write, reinforcing a design that relies on unmanaged secret placement rather than secure storage. While the line itself is only messaging, it supports insecure credential-handling practices that can lead to leakage or mishandling.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The functions for account balance inspection, recharge-order creation, and API pricing are payment/account-management capabilities that do not align with the skill's stated LinkedIn research use case. In this context, hidden financial operations are risky because they can expose sensitive account data or induce unauthorized charges while users expect only data-retrieval behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The utility code is wired to an unrelated external service (openapi.upkuajing.com) and uses a separate API key namespace and local app directory, which does not match the stated LinkedIn employee lookup purpose. This kind of capability mismatch is dangerous because it can redirect user data, queries, or credentials to an unexpected third-party API and indicates the skill may perform actions outside the declared scope.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for pulling LinkedIn employee lists, job titles, and analyzing company hierarchies, but this file implements reporting of runtime errors to a platform endpoint. That telemetry/reporting behavior is not part of the stated employee-lookup or talent-mapping functionality and represents a clear description-to-code mismatch at the skill level.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares no explicit tool scope even though its documented behavior requires environment access, local file reads/writes, and network operations. That mismatch weakens containment and user understanding, increasing the chance the skill is invoked with broader capabilities than necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad enough to match general research, hierarchy analysis, or sales-related requests, which increases the likelihood of accidental or opportunistic activation. In this context, broad activation is more dangerous because the skill can access credentials, contact an external service, and trigger billable operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The description explicitly promotes B2B lead qualification and sales-lead development without any consent, compliance, or policy gating. That creates risk of using scraped or third-party personal/work profile data for profiling or outreach in ways users may not expect and regulations may restrict.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document explicitly instructs agents to transmit request parameters, response data, and error context to a centralized error-reporting API, but it provides no user-facing notice, consent flow, or clear limits on what sensitive business or personal data may be included. Even though it says sensitive fields will be automatically masked, that control is undefined and may not cover all secrets, stack traces, employee-related data, or proprietary request payloads handled by this LinkedIn/company intelligence skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module description and all user-facing help/messages in this file are written exclusively in Chinese, which can amount to forcing a specific language on users without offering a choice. The policy allows locale constraints only when documented and justified or when users can opt in, neither of which is present here.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The finding is substantiated by the require_auth=False parameter, which sets an unsafe default for a sensitive operation: credential provisioning. In the context of a skill advertised for LinkedIn analysis, silently exposing unauthenticated key-creation behavior is especially concerning because users would not expect identity or billing-related backend endpoints to be reachable this way.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60