ClawHub
Back to skill

Security audit

Identifying companies via LinkedIn, locating businesses from LinkedIn data by name,industry, size, and founding year. Helping sales teams, marketers, and B2B lead-generationspecialists discover LinkedIn company profiles, research target clients, and enrichfirmographic data—suitable for customer acquisition, market research, competitor analysis,and account-based sales.

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated LinkedIn company-search purpose, but it handles API keys, paid calls, contact data, and automatic update checks in ways users should review before installing.

Review this skill before installing if you will use a real UpKuaJing account. Do not run commands that print API keys into chat or logs, restrict permissions on `~/.upkuajing/.env`, confirm any paid search or top-up action separately, and treat saved result files as potentially sensitive contact data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:37
Finding

Credential File Contents Are Printed During Setup

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-49
Vulnerability Type: Credential disclosure through Agent-visible command output
Risk Level: High

Vulnerable Code

markdown
This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file content:

text
UPKUAJING_API_KEY=your_api_key_here
text

### Technical Analysis

The setup instructions direct the Agent to print the entire credential file. Although reading `UPKUAJING_API_KEY` is necessary for authenticated requests, displaying the file is not necessary and exceeds minimum privilege.

Command output may be copied into Agent context, chat transcripts, terminal logs, CI logs, or observability systems. The command also exposes every other secret that may be stored in the same file, not only the required API key.

### Attack Path

1. A user or Agent enters the API-key setup or troubleshooting workflow.
2. The documented `cat ~/.upkuajing/.env` command is executed.
3. The complete bearer token is emitted to captured command output.
4. A party with access to the transcript or logs extracts the token.
5. The token is reused to access account information or make paid API requests.

### Impact Assessment

An exposed token can grant the attacker the same UpKuaJing API privileges as the user, including authenticated searches, account-information access, payment-order creation, and other paid operations available to the credential. This does not grant operating-system privilege escalation, but it compromises the external API account and its balance.
Remediation
View remediation

Remediation Suggestions

  • Remove all instructions that print the credential file.
  • Test only whether the required variable exists, without displaying its value.
  • Use the existing get_api_key() routine for programmatic validation.
  • Store only UPKUAJING_API_KEY in the dedicated credential file.
  • Explicitly warn that credentials must never be pasted into chat or diagnostic output.
  • Recommend file mode 0600 and directory mode 0700.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auth.py:61
Finding

Bearer API Key Is Stored Without Enforced Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 61-74
Vulnerability Type: Insecure plaintext credential storage
Risk Level: High

Vulnerable Code

python
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

The relevant destination is defined in scripts/common.py, lines 18-19:

python
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'

Technical Analysis

A newly issued bearer credential is persisted as plaintext using ordinary mkdir() and open() calls. No explicit 0700 directory mode or 0600 file mode is enforced. New-file permissions therefore depend on the process umask and may permit access by other local users.

The write is also not symlink-safe or atomic. If an attacker who can manipulate the destination path pre-creates a symbolic link, the process may truncate and write through that link.

Plaintext storage is expected for an environment file, but it must be protected by explicit access controls because possession of the token is sufficient for authentication.

Attack Path

  1. The user executes python scripts/auth.py --new_key.
  2. A new bearer API key is issued by the remote service.
  3. The script creates ~/.upkuajing/.env using permissions inherited from the current umask.
  4. Another local user or process reads the insufficiently protected file.
  5. The attacker reuses the key for authenticated or paid API operations.

If the destination can be manipulated, an attacker may alternatively pre-create a symlink and cause the credential write to target another file.

Impact Assessment

...[truncated 321 chars]

Remediation
View remediation

Remediation Suggestions

  • Create ~/.upkuajing with mode 0700 and verify its ownership.
  • Create the credential file atomically with mode 0600, such as through os.open() with O_CREAT, O_EXCL, and O_NOFOLLOW where supported.
  • Reject symbolic links and non-regular destination files.
  • Write to a securely created temporary file and atomically replace the destination.
  • Apply chmod(0o600) to existing credential files after verifying ownership.
  • Prefer an operating-system credential store when available.
  • Never include any portion of an existing key in user-visible diagnostic messages.

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Open-Ended and Unhashed Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Non-reproducible dependency resolution without artifact integrity
Risk Level: Medium

Vulnerable Code

text
httpx>=0.23.0

The installation instruction in SKILL.md, line 17, is:

bash
pip install -r requirements.txt

Technical Analysis

The lower-bound-only version constraint allows installation of any future httpx release and its resolved transitive dependencies. The project does not supply exact versions, hashes, or a lockfile.

Consequently, the code actually installed can differ substantially from the version reviewed during the audit. A compromised future package release, compromised transitive dependency, or incompatible update could execute code during installation or alter runtime network behavior.

No evidence shows that the current httpx package is malicious; the vulnerability is the unsafe and non-reproducible dependency policy.

Attack Path

  1. A user follows the setup instructions.
  2. pip resolves the newest package versions satisfying the open-ended constraint.
  3. A future compromised or otherwise unsafe release is selected.
  4. Package installation or import executes unreviewed code in the user's environment.
  5. That code inherits the installing process's filesystem, network, and credential access.

Impact Assessment

Impact is limited by the privileges of the Python or pip process but may include arbitrary code execution under that account, theft of accessible credentials, modification of project files, or interception of API traffic. System-wide impact is possible if installation is performed with administrative privileges.

Remediation
View remediation

Remediation Suggestions

  • Pin httpx to an exact, reviewed version.
  • Lock all transitive dependencies.
  • Generate and verify cryptographic hashes for every package artifact.
  • Use pip install --require-hashes with a reviewed lockfile.
  • Install dependencies in a dedicated virtual environment without administrative privileges.
  • Add automated dependency vulnerability and update review.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/common.py:474
Finding

Contact-Bearing Search Results Are Persisted Without Explicit Protection

Content
View full analysis

Vulnerability Details

File Location: scripts/common.py, lines 474-482
Vulnerability Type: Insecure local storage of potentially sensitive contact data
Risk Level: Medium

Vulnerable Code

python
def append_result_data(task_id: str, data_list: list) -> None:
    result_file = get_task_result_file(task_id)
    ensure_task_dir(task_id)
    with open(result_file, 'a', encoding='utf-8') as f:
        for item in data_list:
            f.write(json.dumps(item, ensure_ascii=False) + '\n')

The write is triggered in scripts/linkedin_company_search.py, lines 139-141:

python
if company_list:
    append_result_data(task_id, company_list)
    total_retrieved += len(company_list)

Technical Analysis

API results are appended as plaintext JSONL under the project-local task_data directory. The directory and result file are created without explicit restrictive permissions, encryption, retention controls, cleanup, or an explicit user-selected destination.

The API reference documents filters and response information associated with telephone numbers, email addresses, valid contact details, and employee contact information. Therefore, the persisted records may contain contact-bearing business datasets.

Persistent output is necessary for resumable large searches, but retaining it with default filesystem permissions is not the minimum safe implementation.

Attack Path

  1. A user runs a search filtered for companies with email, telephone, or employee contact information.
  2. The API returns matching company records.
  3. The script writes the complete records to task_data/<task-id>/result.jsonl.
  4. The files remain on disk without an expiration policy.
  5. Another local process, user, backup consumer, or artifact recipient reads the retained dataset.

Impact Assessment

Exploitation can disclose all company and contact information stored in affected task files. The ...[truncated 202 chars]

Remediation
View remediation

Remediation Suggestions

  • Create task directories with mode 0700 and result files with mode 0600.
  • Verify directory ownership and reject symbolic links before writing.
  • Let the user select or approve the output location.
  • Warn users before persisting records containing contact information.
  • Minimize persisted fields to those explicitly requested.
  • Implement configurable retention and secure deletion of expired task data.
  • Avoid including task data in distributable artifacts, source-control commits, or unrestricted backups.
  • Consider encryption at rest for environments where other local principals can access the storage device.

T01 · Skill Instruction Hijacking

Warning
Location
scripts/version_check.py:94
Finding

Unvalidated Remote Version Value Is Rendered as Agent-Visible Instructions

Content
View full analysis

Vulnerability Details

File Location: scripts/version_check.py, lines 94-124
Vulnerability Type: Remote output and instruction injection
Risk Level: Medium

Vulnerable Code

python
def check_skill_version(skill_name: str, api_base_url: str) -> Optional[str]:
    try:
        url = f"{api_base_url}/agent/api/skills/version"
        headers = {"Content-Type": "application/json"}

        with httpx.Client(timeout=10.0) as client:
            response = client.post(
                url,
                json={"name": skill_name},
                headers=headers
            )
            response.raise_for_status()

            data = response.json()
            if data.get("code") == 0:
                return data.get("data")
    except Exception as e:
        print(f"Error checking skill version:{e}", file=sys.stderr)
    return None


def notify_upgrade(
    skill_name: str,
    current_version: str,
    latest_version: str
):
    notice = (
        f"Skill upgrade notice\n"
        f"Skill: {skill_name}\n"
        f"Current version: {current_version}\n"
        f"Latest version: {latest_version}\n"
        f"Upgrade command: clawhub update {skill_name}"
    )
    print("\n" + notice + "\n", file=sys.stderr)

Technical Analysis

The daily version check accepts the remote response's data field as a version string and inserts it into stderr without validating its type, syntax, size, newlines, or control characters. The request is sent without bearer authentication, although HTTPS still provides transport protection.

In Agent environments, stdout and stderr are commonly ingested into the model's context. A compromised or malicious version endpoint could return multiline instructions that appear alongside a legitimate upgrade command. This creates an instruction-injection channel.

The code does not automatically execute the displayed upgrade command, s ...[truncated 822 chars]

Remediation
View remediation

Remediation Suggestions

  • Require the remote value to be a string matching a strict, bounded semantic-version expression.
  • Reject newlines, terminal escape sequences, control characters, markup, and excessive lengths.
  • Compare versions using a dedicated version parser.
  • Render the value as untrusted data rather than as part of actionable instructions.
  • Make update checks opt-in or move them outside normal API operations.
  • Authenticate or otherwise integrity-protect version metadata where supported.
  • Never automatically execute an update based solely on this response.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/linkedin_company_search.py:65
Finding

Paid Pagination Can Run Without Programmatic User Confirmation

Content
View full analysis

Vulnerability Details

File Location: scripts/linkedin_company_search.py, lines 65-73 and 113-170
Vulnerability Type: Missing enforcement for cost-incurring operations
Risk Level: Medium

Vulnerable Code

python
if args.query_count < 20 or args.query_count > 1000:
    print(
        "Error: query_count must be between 20 and 1000",
        file=sys.stderr
    )
    sys.exit(1)
python
while total_retrieved < args.query_count:
    try:
        response = search_company_list(
            params,
            current_cursor,
            current_pit_id
        )

        if response.get('code') != 0:
            error_message = response.get('msg', 'Unknown error')
            last_request_id = response.get('requestId')
            break

        data = response.get('data', {})
        company_list = data.get('list') or []
        current_cursor = data.get('cursor')

Technical Analysis

SKILL.md requires explicit user confirmation before queries exceeding 20 records because each page is billed. The script itself only validates the numerical range and immediately starts pagination. It has no acknowledgement flag, maximum-cost parameter, or preflight confirmation state.

Prose instructions are not an adequate security boundary because the script can be invoked directly, accidentally, or through a hijacked Agent workflow. A 1,000-record request is expected to require approximately 50 calls when pages contain 20 records.

Attack Path

  1. A direct user, automation system, or compromised Agent invokes the script with a large --query_count.
  2. The script accepts the value because it is within the 20-to-1,000 range.
  3. The pagination loop immediately sends repeated authenticated API requests.
  4. Each successful page incurs charges.
  5. The account balance is consumed without a programmatically verified confirmation.

Impact Assessment

The at ...[truncated 297 chars]

Remediation
View remediation

Remediation Suggestions

  • Require an explicit acknowledgement flag for requests exceeding 20 records.
  • Refuse large paid operations by default.
  • Display the expected page count and require confirmation in a separate step.
  • Bind confirmation to the exact query parameters, requested count, task identifier, and expiration time.
  • Add a user-configurable maximum call count and maximum monetary cost.
  • Stop pagination when the reported cumulative fee exceeds the approved limit.
  • Prefer server-side idempotency and spending limits where the API supports them.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (42)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates additional remote version checks and local cache/version tracking unrelated to the declared company-search purpose. Even if operationally common, undisclosed background network calls and local state create hidden side effects and expand the attack surface beyond what a user would reasonably expect from a search skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The finding indicates additional remote version checks and local cache/version tracking unrelated to the declared company-search purpose. Even if operationally common, undisclosed background network calls and local state create hidden side effects and expand the attack surface beyond what a user would reasonably expect from a search skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates additional remote version checks and local cache/version tracking unrelated to the declared company-search purpose. Even if operationally common, undisclosed background network calls and local state create hidden side effects and expand the attack surface beyond what a user would reasonably expect from a search skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The finding indicates additional remote version checks and local cache/version tracking unrelated to the declared company-search purpose. Even if operationally common, undisclosed background network calls and local state create hidden side effects and expand the attack surface beyond what a user would reasonably expect from a search skill.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill explicitly instructs reading ~/.upkuajing/.env to access an API key, which is direct credential access to a local secret store. A research-oriented skill should not encourage exposing raw secret files or normalizing secret inspection in user workflows, because this can leak credentials through logs, prompts, screenshots, or downstream tooling.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash
cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill directs the agent to check for and manage UPKUAJING_API_KEY inside a local .env file and to write newly created keys there automatically. This combines secret discovery and secret persistence in a general-purpose skill, increasing the chance of credential mishandling, unauthorized storage, or accidental disclosure through file access and automation.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This section continues the pattern of encouraging inspection of ~/.upkuajing/.env and automatic saving of newly issued credentials. In context, that is especially risky because the skill also has network and file capabilities, so a mis-scoped or compromised workflow could both harvest and use the credential without the user understanding the full exposure.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file implements API key issuance, account lookup, recharge-order creation, and pricing retrieval, which are materially outside the stated purpose of a LinkedIn company-search and firmographic-enrichment skill. Scope expansion into account and billing operations increases attack surface, enables misuse of user accounts or funds, and makes it harder for users to understand what privileged actions the skill may perform.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

Writing a freshly issued API key directly to a plaintext .env file in the user's home directory creates a local secret-exposure risk. If filesystem permissions are weak, backups/sync tools capture the file, or other tooling logs or reads that directory, the credential could be disclosed and reused to access the associated service.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Creating recharge orders is unrelated to firmographic company search and introduces a financial operation into a data-enrichment skill. If invoked unexpectedly or abused, it could facilitate unauthorized payment flows, social-engineering of operators, or unintended charges through a skill that users would not expect to handle billing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code is explicitly wired to the UpKuajing API and its credential namespace, which does not match the declared LinkedIn company-search purpose of the skill. In an agent-skill context, this mismatch is dangerous because it can cause data to be sent to an undeclared third-party service and can mislead reviewers and users about where requests and credentials are going.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This file adds error-reporting behavior that is unrelated to the advertised LinkedIn company search function, which is a strong indicator of scope creep and hidden data flows. Even if intended for diagnostics, the code automatically reports request metadata and context to an external endpoint, creating an undisclosed telemetry channel that could carry sensitive operational or user-derived data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares capabilities that imply environment access, file reads/writes, and network use, but it does not define any explicit tool scope or permission boundaries. That makes it harder to constrain execution and increases the chance that a benign-looking research skill can access local secrets or perform side effects beyond what users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list is broad and overlaps with common research, sales, and competitor-analysis requests, making accidental or overbroad activation more likely. In a skill that can access local credentials, perform network calls, and initiate billing-related flows, ambiguous triggering increases the chance of unintended execution and data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instruction says industry and product names must be in English, which imposes a language requirement on users. The file does not offer a language choice, describe translation behavior with user consent, or justify this as a documented region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The statement "Industry names must be in English" is a language-policy restriction expressed in natural language. Because the skill does not provide opt-in, alternatives, or a clear documented reason for this locale limitation, it conflicts with the requirement to avoid forcing a language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation explicitly enables filtering on the existence of phone numbers, email addresses, WhatsApp, valid contact methods, and core member contact details, but provides no privacy, consent, or lawful-use guidance. In a sales outreach and enrichment skill, this omission materially increases the risk of using sensitive contact data for intrusive profiling, scraping, or non-compliant outreach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The response schema includes a field that displays an employee contact record, which can expose personal or direct-contact information, yet the document gives no warning about sensitivity or handling requirements. Because the skill is designed for B2B prospecting and competitor research, returning employee contact data without safeguards creates a realistic risk of privacy misuse and non-compliant downstream processing.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:58