ClawHub
Back to skill

Security audit

LinkedIn 公司搜索，按名称、行业、规模与成立年份从 LinkedIn 数据找公司。 帮助销售团队、营销人员与 B2B 线索构建者发掘 LinkedIn公司档案、研究目标客户、丰富企业画像数据——适合客户开发、市场调研、竞品分析与账户式销售。

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a paid LinkedIn company-search tool, but it handles API keys, payment-order flows, local result storage, and an undisclosed version-check cache in ways users should review before installing.

Review this skill before installing. Use it only if you are comfortable sending search queries to Upkuajing, paying for API calls, and storing results locally. Do not print the `.env` file in chat or logs; prefer an environment variable or secret store, restrict permissions on `~/.upkuajing` and task data, and manually confirm any recharge, paid query, or error report that may include request or response details.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:62
Finding

API Key Disclosure Through Credential-File Output and Insecure File Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/common.py:423
Finding

Sensitive Search Results and Query Metadata Use Process-Default File Permissions

Content
View full analysis
str: """ Ensure that the task directory exists. """ task_dir = get_task_dir(task_id) os.makedirs(task_dir, exist_ok=True) return task_dir def save_task_meta(task_id: str, meta: Dict[str, Any]) -> None: """ Save task metadata to a file. """ meta_file = get_task_meta_file(task_id) ensure_task_dir(task_id) with open(meta_file, 'w', encoding='utf-8') as f: json.dump(meta, f, ensure_ascii=False, indent=2) def load_task_meta(task_id: str) -> Optional[Dict[str, Any]]: """ Load task metadata from a file. """ meta_file = get_task_meta_file(task_id) if not os.path.exists(meta_file): return None with open(meta_file, 'r', encoding='utf-8') as f: return json.load(f) def append_result_data(task_id: str, data_list: list) -> None: """ Append result data to the task result file. """ result_file = get_task_result_file(task_id) ensure_task_dir(task_id) with open(result_file, 'a', encoding='utf-8') as f: for item in data_list: f.write(json.dumps(item, ensure_ascii=False) + '\n') ``` ### Technical Analysis Task directories, metadata files, and JSONL result files are created without explicit access modes. Their permissions depend on the host process umask. A permissive umask can make files readable by other users on a shared system. According to the reviewed API reference, records can contain detailed company addresses and a displayed employee contact through `person_contact_show`. Metadata also preserves the original query parameters, cursor, PIT identifier, task state, and requested record count. These files can therefore disclose business-research targets, contact i ...[truncated 1345 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Dependency Version Allows Unreviewed Future Releases

Content
View full analysis
=0.23.0 ``` The installation instructions execute: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency specification defines only a minimum version and no upper bound, lock file, or integrity hash. A fresh installation may therefore select any later `httpx` release and its transitive dependencies, including releases that were not reviewed with this Skill. This does not establish that the current `httpx` package is malicious. The weakness is that installation is not reproducible and implicitly trusts future package and transitive-dependency versions. Unexpected upstream changes could introduce incompatibility or expose the Skill to a compromised supply-chain release. ### Attack Path 1. A user follows the documented installation procedure. 2. The Python package resolver selects the latest version satisfying `httpx>=0.23.0`, along with its then-current transitive dependencies. 3. A future incompatible or compromised release is installed without a corresponding Skill review. 4. The dependency executes within the Python process when the Skill imports or uses `httpx`. 5. A compromised dependency would inherit the Skill process’s access, potentially including access to the API key, task result files, and outbound network connectivity. This attack path depends on compromise or unsafe behavior in a future permitted package release; no such malicious dependency was identified in the reviewed artifact. ### Impact Assessment The potential impact is bounded by the privileges of the Python process. In a supply-chain compromise, this could include reading the API key, accessing stored search results, altering local files available to the user, or transmitting data over the network. The present finding is lower ri ...[truncated 187 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (46)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undeclared version-check networking, reads of SKILL.md, and writes to a cache file under the user's home directory even when no core LinkedIn search is performed. Hidden background behaviors are risky because they create side effects and external communications unrelated to the user-requested business function, undermining transparency and increasing the attack surface.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undeclared version-check networking, reads of SKILL.md, and writes to a cache file under the user's home directory even when no core LinkedIn search is performed. Hidden background behaviors are risky because they create side effects and external communications unrelated to the user-requested business function, undermining transparency and increasing the attack surface.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates undeclared version-check networking, reads of SKILL.md, and writes to a cache file under the user's home directory even when no core LinkedIn search is performed. Hidden background behaviors are risky because they create side effects and external communications unrelated to the user-requested business function, undermining transparency and increasing the attack surface.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill explicitly instructs reading ~/.upkuajing/.env with cat, exposing a local credential store to the agent workflow. Even if intended to check setup, encouraging direct file reads of secret-bearing files increases the chance of accidental secret disclosure to the model, logs, or downstream outputs.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash
cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The setup flow instructs checking the user's .env file and, if absent, obtaining a new key and automatically saving it under the user's home directory. This blends credential discovery, acquisition, and persistence into a search skill, increasing the risk of unauthorized secret handling and long-lived credential storage without strong scope controls.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This repeated instruction reinforces that the agent may inspect and modify ~/.upkuajing/.env, a sensitive local credential file. In the context of a data-search skill, that is more dangerous because the user expectation is low-risk querying, not secret file access and persistence on disk.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file implements API key provisioning, account information lookup, and payment-related operations that are materially broader than the declared LinkedIn company search skill purpose. In an agent-skill ecosystem, this kind of scope expansion increases trust abuse risk because users may invoke a search skill without expecting credential enrollment or billing workflows.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The function is explicitly designed to handle API secrets via a .env file, indicating local credential material is being managed in plaintext file-based storage. Plaintext secret handling raises the risk of accidental disclosure through backups, permissive file permissions, or local compromise, especially in an agent environment where users may not expect credential persistence.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

Reading an existing .env file to recover API keys confirms the skill accesses locally persisted secrets. This expands the credential exposure surface because any process with access to the file may obtain the key, and the skill normalizes secret retrieval from a non-hardened location.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Writing the newly issued API key directly to a .env file stores a live credential in plaintext on disk. If that file is readable by other local users, synced to cloud storage, committed to source control, or included in logs/backups, the credential can be stolen and used to access the backend API.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

The error path continues to encourage manual environment-variable handling and discloses the secret storage path, reinforcing insecure credential management patterns. While lower severity than the actual write, it still contributes to unsafe operational handling of secrets.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

Creating recharge orders and returning payment URLs is a financial capability unrelated to company search/filtering, so embedding it here creates an unexpected billing surface. If exposed through the skill, it could be abused for unauthorized charge initiation, phishing-like payment redirection, or stealth monetization under a misleading capability label.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata claims a LinkedIn company search capability, but this module is wired to a different third-party service and its authentication flow. That mismatch is dangerous because it can cause users and reviewers to grant trust and credentials under false assumptions, enabling undisclosed data transfer to an external provider.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
def load_env_file() -> Dict[str, str]:
    """
    从 ~/.upkuajing/.env 文件加载环境变量。

    Returns:
        环境变量字典

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares capabilities that include environment access, local file read/write, and network activity, but does not scope or constrain those tools in the manifest. This creates unnecessary trust ambiguity: a user invoking a company-search skill would not reasonably expect credential file access, local persistence, or auxiliary network operations such as pricing, recharge, version checks, and telemetry-related calls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation expands the skill from company search into API key application, recharge, pricing, and exception reporting workflows. While not proof of exploit code by itself, this is a substantive scope creep indicator that can lead users to authorize credential, billing, and outbound-reporting actions under the guise of a simple search skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

该 markdown 明确写明“行业和产品名称需使用英文”，属于自然语言层面的语言约束。文档未说明这是用户可选项，也未将其限定为特定地区合规要求，因此构成语言/locale policy 风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

该处再次以强制语气规定“行业名称需要使用英文”。这会将特定语言作为默认要求施加给用户，而没有提供可选语言方案或明确说明该限制的必要性。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The API explicitly supports filtering for the existence of personal and business contact channels, including valid phone/email and core member contact availability, but the documentation provides no privacy, consent, or lawful-use constraints. In a lead-generation and ABM context, this materially increases the risk of bulk targeting, scraping, and misuse of personal contact data for unsolicited outreach or profiling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The response schema states that a record may include displayed employee contact information, exposing sensitive personal data without any warning, masking guidance, or access-control expectations in the documentation. Because the skill is designed for customer development and account-based marketing, the surrounding context makes this more dangerous by encouraging operational use of exposed contact details for direct outreach at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation explicitly allows transmitting request parameters, response data, and exception context to an error-reporting API, which can include sensitive business data, identifiers, stack traces, or user-provided content. Although it mentions automatic masking of sensitive fields, it does not define what is redacted, require minimization, or warn operators not to include secrets and personal data, creating a realistic privacy and data-exposure risk through logging/telemetry.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring and user-facing CLI descriptions are written only in Chinese, which imposes a specific language on users. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196