Identifying companies via LinkedIn, locating businesses from LinkedIn data by name,industry, size, and founding year. Helping sales teams, marketers, and B2B lead-generationspecialists discover LinkedIn company profiles, research target clients, and enrichfirmographic data—suitable for customer acquisition, market research, competitor analysis,and account-based sales.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:34 AM UTC
• Version: 1.0.3

Overview

This skill mostly matches a paid LinkedIn company-search service, but it combines credential storage, billing/top-up flows, contact-data retrieval, remote diagnostics, and an undisclosed automatic version check that users should review before installing.

Install only if you are comfortable using UpKuaJing as a paid third-party data provider, storing its API key in a local plaintext file, and sending search/error-report data to its API. Confirm charges before searches, avoid reporting raw prompts or customer data, and review privacy/compliance obligations before using contact-data filters for outreach.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes Python scripts that read environment variables, access local files such as ~/.upkuajing/.env, write task data, and call remote APIs, yet it does not declare corresponding permissions. This creates a transparency and consent problem: users and orchestrators may authorize the skill based on an incomplete capability profile, increasing the chance of unintended credential, filesystem, or network exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The advertised purpose is simple company search, but the skill also performs credential provisioning/storage, account balance lookups, payment order creation, pricing retrieval, error reporting, version checks, and local persistence. That mismatch is dangerous because operators may invoke a data-search skill without realizing it can handle secrets, initiate billing-related flows, transmit telemetry, or persist sensitive metadata locally.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements authentication, API key issuance, account lookup, pricing, and recharge/payment flows for a third-party service ('跨境魔方'), which does not align with the stated LinkedIn company-search purpose. Capability mismatch is dangerous because users may invoke the skill expecting benign LinkedIn research while actually onboarding to an unrelated external platform and exposing themselves to undisclosed account, billing, and data-transfer risks.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code exposes account-balance and recharge-order creation capabilities that are unjustified by a LinkedIn research/enrichment workflow. This creates financial-risk surface: a user or calling agent could be led into account funding or payment actions unrelated to the advertised purpose, increasing the chance of unauthorized charges, social engineering, or hidden monetization.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This module performs outbound network access and persistent local cache writes that are unrelated to the stated purpose of LinkedIn company search and firmographic enrichment. Even if framed as version checking, it creates an extra communication channel and filesystem side effects, which increases privacy, telemetry, and supply-chain risk in a skill that users would not expect to contact a separate service for self-maintenance behavior.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code implements self-update telemetry by posting the skill name to a remote API endpoint, which is not justified by the declared LinkedIn research functionality. In context, this hidden runtime beaconing is more dangerous because the skill’s business purpose does not require background update checks, so users may be unaware that the skill reports usage-related metadata and depends on a remote service outside its core function.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are broad enough to match generic B2B research, enrichment, or competitor-analysis requests, which can cause the skill to activate outside the user's specific intent. In this skill, over-activation matters more because execution may lead to paid API calls, network transmission, local file access, and credential-related flows.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The API reference explicitly exposes filtering and retrieval of company and employee contact-related data, including valid phone, email, website, WhatsApp, and core member contact existence, without any privacy, consent, or acceptable-use guidance. In a sales outreach and firmographic enrichment skill, this materially increases the risk of scraping, profiling, and misuse of personal or quasi-personal contact data in ways that may violate privacy law, platform terms, or internal compliance requirements.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly instructs callers to send request parameters, response data, and error context to a remote error-reporting API, and it does not require user notice, consent, or strict minimization before transmission. Even though it says sensitive fields will be auto-masked, this is insufficient assurance because stack traces, request payloads, and response bodies frequently contain secrets, personal data, or proprietary business information that may not be reliably identified and redacted.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code forwards request metadata and free-form context to a remote endpoint via make_request('/agent/skill/error/report', params) without any visible minimization, redaction, or disclosure controls. If requestPath, requestId, or especially context can contain customer data, tokens, prompts, or other sensitive operational details, error reporting can become an unintended data exfiltration path.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs the agent to inspect ~/.upkuajing/.env for UPKUAJING_API_KEY and to store newly created keys there automatically. Accessing and persisting credentials in a local dotfile is sensitive behavior; if the agent or surrounding platform has broader filesystem visibility than expected, this can expose secrets, normalize secret scraping patterns, or overwrite existing credential material without strong safeguards.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: This instruction continues the credential-handling flow by telling the agent to determine whether UPKUAJING_API_KEY is present and then either accept user-provided secret material or generate and save a new key. The danger is heightened by the skill context because a simple search utility now becomes a credential bootstrapper with local secret persistence, increasing the attack surface for secret leakage, unauthorized account linkage, and accidental billing under the wrong account.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: The code writes a newly issued API key directly into a plaintext .env file under a user directory. Plaintext credential storage increases the risk of local compromise, accidental disclosure via backups or tooling, and secret leakage if the file is later copied, logged, or committed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 94% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any future version. This makes builds non-reproducible and can unexpectedly pull in breaking changes or a compromised upstream release, increasing supply-chain risk over time. In a skill that performs external company-search/network operations, dependency behavior matters because HTTP client changes can affect request handling, redirects, proxies, and TLS behavior.

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58