LinkedIn 校友查询，按学校 ID 与人员 ID 从 LinkedIn 数据发掘含人员的校友关系。帮助招聘人员、销售团队与 B2B线索构建者发掘校友关系网、追溯教育关联、扩展联系清单——适合人才寻源、院校关系网研究与线索生成。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:36 AM UTC
• Version: 1.0.5

Overview

This is a disclosed paid API wrapper for LinkedIn alumni lookup, with local API-key storage and account support helpers but no artifact-backed deception or destructive behavior.

Install only if you are comfortable using a paid external Upkuajing API, storing its API key in a local plaintext .env file, and sending lookup/error-report data to that service. Confirm any charged lookup or recharge-related action before the agent runs it, and avoid putting secrets or personal data into error-report context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions while its documentation clearly instructs use of environment variables, local file reads/writes to ~/.upkuajing/.env, and networked API operations. This creates a transparency and consent problem: users and policy systems cannot accurately assess what the skill can access or modify before use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated purpose is alumni/ex-employee discovery, but the skill also includes credential provisioning, account inspection, recharge order creation, pricing lookup, error-report submission, and version checks. This mismatch is dangerous because it expands the operational scope into billing, credential lifecycle, and outbound reporting without that broader capability being made explicit in the description.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documentation includes workflows for API key issuance, recharge order creation, account information retrieval, price lookup, and exception reporting that go beyond alumni lookup. In context, these side capabilities increase exposure to credential handling, financial actions, and data egress, making the skill more dangerous than its advertised business-discovery purpose suggests.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements API key provisioning, account balance lookup, pricing lookup, and recharge order creation for an external service, which is materially different from the declared LinkedIn alumni/former-employee discovery purpose. That mismatch increases the chance the skill is acting as a hidden monetization or credential-brokering component, and it exposes users to unintended account and billing actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Providing recharge-order creation plus account balance and pricing queries exceeds the reasonable scope of a LinkedIn relationship-mining skill. In context, these capabilities can facilitate unauthorized spending, billing abuse, or covert monetization through the agent under a misleading functional description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This module performs behavior outside the skill’s stated alumni/business-discovery purpose: it contacts a remote service and writes persistent state under the user’s home directory. Even though the transmitted data is limited and the feature looks like routine update checking, the hidden network call and local persistence expand the skill’s trust boundary and can enable unauthorized telemetry or future abuse if the API base URL is attacker-controlled or not clearly disclosed.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code implements self-update checking that is unrelated to the advertised LinkedIn/alumni analysis function, creating an unnecessary network-capable control path. Such side functionality is risky in agent skills because it can be repurposed for command-and-control-style signaling, package targeting, or environment profiling, especially when triggered automatically on first API use.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly encourages sending request parameters, response payloads, and exception context to an error-reporting endpoint. Even though it states that sensitive fields are automatically desensitized, it does not define what is redacted, require minimization, or warn operators not to include personal data, tokens, stack traces with secrets, or third-party data. In this skill’s LinkedIn/personnel context, those fields may contain employee, alumni, or business relationship data, making accidental privacy leakage to centralized logs a realistic risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The request/response logging functions can persist full API parameters and full API responses to local log files under the user's home directory. If logging is enabled, this may store personal data, query contents, and possibly sensitive business data without redaction, consent, retention controls, or access restrictions, creating a local data exposure risk.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script forwards a caller-supplied context field to a remote error-reporting endpoint without any visible minimization, redaction, or disclosure controls. If context contains prompts, identifiers, request payloads, or user-derived LinkedIn/person/company data, operational failures could exfiltrate sensitive information to the platform unnecessarily.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The module sends the skill name to a remote API without any user-facing disclosure in this file, which is a privacy/transparency issue. While the payload is not highly sensitive by itself, it still reveals installed/used capability metadata and establishes external communication that users may not expect from this skill.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 95% confidence
• Finding: The skill instructs checking and using a credential stored in ~/.upkuajing/.env, which involves access to local secret material. In agent contexts, prompting for inspection of dotfiles or automated handling of API keys can expose credentials to the skill runtime, logs, or unintended downstream actions if not tightly controlled.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 97% confidence
• Finding: The skill goes beyond reading a credential and instructs automatic key application plus saving the new API key into ~/.upkuajing/.env. This combines credential generation with persistent local secret writeback, increasing the risk of unauthorized secret creation, storage in an unsafe location, and later leakage through filesystem access or support workflows.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 90% confidence
• Finding: The code writes a newly issued API key directly into a plaintext .env file under the user's home directory without any visible permission hardening or secure storage mechanism. If local filesystem permissions are weak, backups are exposed, or other tooling reads that file, the credential can be stolen and used to access the external service or incur charges.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower bound only (httpx>=0.23.0), which allows future major or minor releases to be installed without review. This can introduce supply-chain instability, unexpected breaking changes, or newly introduced vulnerable versions into the skill at install time, especially for network-facing code that likely relies on HTTP client behavior.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196