LinkedIn 公司搜索，按名称、行业、规模与成立年份从 LinkedIn 数据找公司。 帮助销售团队、营销人员与 B2B 线索构建者发掘 LinkedIn公司档案、研究目标客户、丰富企业画像数据——适合客户开发、市场调研、竞品分析与账户式销售。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed paid API integration for LinkedIn company search, with expected but sensitive handling of API keys, local result files, and optional error reporting.

Install only if you are comfortable using Upkuajing's paid API. Confirm costs before searches, avoid approving error reports that include secrets or customer data, and protect or restrict access to ~/.upkuajing/.env because it stores the API key in plaintext.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises no explicit permissions, yet its instructions require environment-variable access, reading and writing files under ~/.upkuajing, and making network requests to external services. This creates a transparency and consent problem: an agent or user may invoke the skill expecting simple search behavior while it can also access local credentials and persist data, increasing the risk of unauthorized credential handling or unintended external calls.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is company search, but the skill also performs account lifecycle and billing actions such as creating API keys, writing them to disk, creating recharge orders, fetching pricing, reporting telemetry-like errors, and checking for version updates. This mismatch is dangerous because users may authorize a data-search tool without realizing it can modify local credential state, initiate billable/account actions, and communicate additional metadata to the vendor.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs callers to upload `requestParams`, `responseData`, and especially `context` containing stack traces or error details, but it does not clearly warn that these fields may contain credentials, personal data, business data, or other sensitive content. Although it mentions automatic masking of sensitive fields, that statement is incomplete because masking rules may be partial or fail to catch secrets embedded in free-text context, creating a realistic risk of unintended data exfiltration into centralized logging or reporting systems.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script submits an arbitrary `context` field and request metadata to a remote error-reporting endpoint without any visible minimization, redaction, or user-facing disclosure. In an agent/skill environment, error context often contains prompts, identifiers, request paths, or business data, so transmitting it as-is can leak sensitive operational or customer information.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 96% confidence
• Finding: The skill instructs the agent to inspect ~/.upkuajing/.env for an API key and to generate and automatically save a new key there if missing. Accessing and modifying local credential stores is sensitive because it involves secrets handling, persistence on disk, and the possibility of exposing, overwriting, or misusing credentials beyond the user's informed intent.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 95% confidence
• Finding: This adjacent instruction continues the same credential-handling behavior: prompting for a user-provided API key or automatically requesting one and writing it into ~/.upkuajing/.env. In the context of a search skill, bundling secret acquisition and local secret-file writes makes the behavior more dangerous because it normalizes credential collection and persistence in a tool whose primary purpose is unrelated to credential management.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 78% confidence
• Finding: The code writes a newly issued API key into a plaintext .env file under the user's home directory without showing any permission hardening. If the file is created with permissive defaults or on a shared/misconfigured system, other local users or processes could read the credential and abuse the account.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows future major or minor releases to be installed without review. This can introduce breaking changes or a compromised/upstream-vulnerable version through the supply chain, reducing build reproducibility and making security posture harder to control.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196