Identifies alumni connections from LinkedIn datasets using school-ID and personnel-IDinputs. It maps out alumni-related ties linked to individuals and educationalinstitutions. Recruiters, sales teams and B2B lead-generation specialists explore alumninetworks, track educational-background connections and build expanded contact databases.This tool works well for talent sourcing, institutional-network research and B2Blead-generation workflows.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:16 AM UTC
• Version: 1.0.5

Overview

The skill mostly does what it says, but it asks the agent to expose a local API-key file and persists credentials without strong safeguards.

Review before installing. This skill uses a paid third-party UpKuaJing API, sends LinkedIn-related identifiers to that service, can create payment/top-up flows, and stores an API key under your home directory. Do not let an agent print `~/.upkuajing/.env`; prefer setting only `UPKUAJING_API_KEY` through a scoped secret mechanism, and confirm every paid or error-reporting action explicitly.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:40

Finding

Unnecessary Disclosure of the Credential File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:71

Finding

API Key Stored Without Explicit Owner-Only File Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Version

Content

View full analysis

=0.23.0 ``` The installation instruction that activates this dependency resolution appears in `SKILL.md`: ```markdown 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The dependency specification accepts every `httpx` release at or above version `0.23.0`. It does not provide: - An exact reviewed version - An upper compatibility bound - Package integrity hashes - A lock file - A requirement to use a trusted package index As a result, installations performed at different times can resolve to different code. A compromised package release, compromised package index, or future incompatible version could alter network and credential-handling behavior without any change to the audited skill package. No evidence was found that the currently named `httpx` package is malicious. The vulnerability is the uncontrolled and non-reproducible supply-chain policy, not a confirmed malicious dependency. ### Attack Path 1. A user follows the setup instructions and runs `pip install -r requirements.txt`. 2. The package resolver queries the configured Python package index. 3. It selects an unreviewed future release satisfying `httpx>=0.23.0`, or a package supplied by a compromised or untrusted index. 4. Package code is installed into the skill's execution environment. 5. The installed code executes during import or subsequent HTTP operations. 6. A malicious dependency could inspect process data, intercept the Bearer credential, alter API requests, or execute code with the privileges of the user running the skill. ### Impact Assessment If dependency resolution is compromised, malicious package code would run with the same operating-system privileges as the Python process. Depending on the host e ...[truncated 456 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks and local cache writes in the user's home directory are ancillary behaviors not evident from the declared alumni-search purpose. These extra capabilities expand the attack surface by enabling persistent local state changes and unsolicited outbound requests that users may not expect from a simple lookup tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Remote version checks and local cache writes in the user's home directory are ancillary behaviors not evident from the declared alumni-search purpose. These extra capabilities expand the attack surface by enabling persistent local state changes and unsolicited outbound requests that users may not expect from a simple lookup tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks and local cache writes in the user's home directory are ancillary behaviors not evident from the declared alumni-search purpose. These extra capabilities expand the attack surface by enabling persistent local state changes and unsolicited outbound requests that users may not expect from a simple lookup tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote version checks and local cache writes in the user's home directory are ancillary behaviors not evident from the declared alumni-search purpose. These extra capabilities expand the attack surface by enabling persistent local state changes and unsolicited outbound requests that users may not expect from a simple lookup tool.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly instructs reading ~/.upkuajing/.env, which is a credential store containing API secrets. Directing an agent to access local secret files is dangerous because it can expose tokens beyond least-privilege needs, and the file may contain additional sensitive values beyond the single API key referenced.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The workflow asks the agent to check the local .env file for a key and potentially guide manual insertion of credentials into that file. This creates unnecessary credential handling by the agent and increases the chance of secret disclosure, mishandling, or persistence in an insecure location.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Automatically applying for a new key and saving it to ~/.upkuajing/.env combines credential creation with local persistence in a general-purpose secret file. This is risky because it normalizes automatic secret generation/storage by the skill and may leave long-lived credentials on disk without adequate user review, rotation, or access controls.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements account provisioning, balance lookup, pricing, and recharge flows for a third-party platform, which does not align with the declared LinkedIn alumni discovery purpose. This kind of scope mismatch is dangerous because it can conceal unexpected credential, billing, and external-service interactions behind an unrelated skill description, reducing informed user consent and review effectiveness.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Writing a newly created API key directly into a .env file on disk stores a sensitive credential in plaintext, which can be exposed through weak file permissions, backups, logs, or accidental inclusion in tooling. In a mismatched skill context, this is more concerning because users may not realize the skill is provisioning and persisting third-party credentials at all.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Creating recharge orders and exposing pricing/account management inside an alumni discovery skill introduces payment-related capability that is unrelated to the advertised function. Hidden monetization or billing actions in a mismatched context increase the risk of unauthorized charges, deceptive behavior, and users triggering financial workflows they did not expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code is wired to a generic third-party Upkuajing API service rather than a narrowly scoped LinkedIn alumni capability, which indicates scope expansion beyond the declared skill purpose. In an agent skill, this mismatch is dangerous because it can route user data to an unrelated external service and enable undisclosed data processing outside the expected trust boundary.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest describes a skill for finding LinkedIn alumni connections using school and personnel identifiers, but this code only validates error-report parameters and sends them to an '/agent/skill/error/report' endpoint. That behavior is operational telemetry for the hosting platform, not part of alumni research, talent sourcing, or B2B contact enrichment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares access patterns that involve environment variables, filesystem reads/writes, and network operations, but it does not declare an explicit tool scope or permission boundary. That makes the real capability surface opaque to users and reviewers, increasing the chance that credential access, local file modification, or external requests occur without clear authorization expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation instructs the agent to perform API-key provisioning, account top-up, price lookups, and error-report submission in addition to alumni discovery. These capabilities materially expand the financial, privacy, and account-management risk of the skill, especially because users may invoke it expecting only a search function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The API explicitly supports sending request parameters, response payloads, and exception context to a centralized error-report endpoint. Even though it states sensitive fields will be automatically masked, there is no explicit guidance to minimize data collection, avoid secrets/PII in context strings, or obtain user/operator awareness before transmitting potentially sensitive debugging data, creating a real privacy and data-leakage risk through logs and telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code silently performs a network request to create a new API key and then stores that credential locally, without an explicit warning about transmitting data to a remote service and writing secrets to disk. Even if intended, this is risky because users may not understand they are provisioning credentials for a third-party service or where those credentials will persist.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:61