LinkedIn 同事查询，按公司 ID 与人员 ID 从 LinkedIn 数据找同事与团队成员。帮助招聘人员、销售团队与 B2B线索构建者发掘团队关系网、绘制组织关系、扩展联系清单——适合关系网拓展、背调调研与客户信息分析。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:58 AM UTC
• Version: 1.0.5

Overview

The skill performs the advertised colleague lookup, but it also handles API keys, account billing, recharge orders, and diagnostics in ways users should review before installing.

Review this before installing if you are not comfortable with a skill reading or creating an API key, storing it under ~/.upkuajing, accessing account balance details, creating recharge payment URLs, and sending confirmed error reports to the provider. Do not display the .env file contents in chat or logs; verify key presence without printing the secret.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit permissions while its documented behavior includes environment-variable access, reading and writing local files under ~/.upkuajing, and making network requests. This under-declaration reduces transparency and informed consent, making it easier for a user or host agent to invoke sensitive capabilities without realizing the true scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes materially beyond the stated purpose of colleague lookup by adding API key issuance, local secret storage, account inspection, recharge order creation, pricing queries, version checks, and exception reporting. This broadens the attack surface and can lead to unexpected financial actions, secret handling, and outbound data transmission under the guise of a simple LinkedIn colleague-search skill.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Including API key application, recharge order creation, and account-information retrieval in a colleague-search skill introduces financial and credential-management operations unrelated to the core business purpose. Users may authorize the skill expecting only data lookup, while it can also initiate actions affecting accounts and billing.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The exception-reporting feature transmits operational context and request identifiers to the platform, which is outside the core purpose of colleague retrieval. Even if intended for support, it creates an outbound data-sharing path that could disclose user activity, identifiers, or query context unnecessarily.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements API key issuance, account inspection, and payment-related functions that are materially unrelated to the declared purpose of discovering colleagues and business contacts from LinkedIn data. This scope mismatch is dangerous because it expands the skill’s capabilities into credential provisioning and billing operations, increasing the chance of hidden monetization, unauthorized account actions, or abuse beyond the user’s expected consent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Creating recharge/payment orders is outside the stated business purpose of a contact-discovery skill and introduces a financial operation that a user would not reasonably expect. In a skill context, hidden or unnecessary payment flows are high risk because they can trigger unwanted billing activity or serve as a foothold for monetization abuse.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Account balance and API pricing queries expose billing and service-usage metadata unrelated to the advertised contact-finding purpose. While less severe than active payment creation, this broadens access to sensitive business/account information and may facilitate reconnaissance of account state, spending capacity, or platform usage.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The logging helpers can write full request parameters and full API responses to local disk, which may include personal data, query targets, or account-related information. Even though logging is disabled by default, enabling it creates a privacy and data-retention risk without redaction or user warning, which is more sensitive in a people-enrichment/relationship-mapping skill context.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script performs platform telemetry/error reporting rather than the LinkedIn colleague-discovery functionality described by the skill metadata, which is a strong capability mismatch. Such hidden or undisclosed network reporting expands the data flow beyond the declared purpose and can expose request identifiers, paths, and context to a remote endpoint without clear user expectation, making the skill materially more risky in this context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs reading the local ~/.upkuajing/.env file directly, and even suggests using cat to display it, without warning that this can expose API keys in plaintext. In an agent context, such guidance risks secret disclosure to logs, UI output, or downstream systems not authorized to see the credential.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Request/response logging to disk can persist transmitted data without user awareness, potentially exposing sensitive LinkedIn-derived or business-contact data to other local users, backups, or incidentally shared files. Because this skill processes relationship and organizational information, silent storage increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends request metadata and arbitrary context to '/agent/skill/error/report' without any user-facing notice, confirmation, or visible sanitization. Because 'context' may contain stack traces, prompts, personal data, or business data from failed requests, this can leak sensitive information to the platform and violates least-privilege and transparency expectations.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The version check transmits the skill name to a remote API without any disclosure, consent, or visible user control in this file. Although the data sent is low sensitivity, undisclosed outbound telemetry expands the privacy and trust surface, especially because this skill's stated purpose is people/organization discovery rather than update management.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: This instruction directs the agent to inspect a local secret store and, if absent, to automatically request a new API key and save it to ~/.upkuajing/.env. That combines credential discovery, credential creation, and local secret persistence, which are sensitive operations that can expose or misuse account access if invoked in the wrong context.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: The same flow continues by coupling local .env inspection with credential provisioning and subsequent account-related operations, increasing the chance of unauthorized secret handling. In the context of a business-contact lookup skill, this is more dangerous because users would not reasonably expect credential-management behavior from the advertised function.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: The script stores a newly issued API key in plaintext in a .env file under the user’s home directory, which increases exposure if the file is readable by other local users, backups, or other tooling. In a skill that already exceeds its declared scope, local plaintext credential persistence is more concerning because it enables later unauthorized API use if the host is shared or compromised.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 93% confidence
• Finding: The error path instructs the user to manually set the API key as an environment variable and elsewhere the script prints a truncated existing key, reflecting weak secret-handling practices around credential exposure and persistence. While not an exploit by itself, this promotes insecure operational handling of sensitive API credentials.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only (`httpx>=0.23.0`), which allows installation of any newer version, including future releases that may introduce breaking changes, vulnerable transitive dependencies, or malicious supply-chain compromises. In a skill that relies on external networking and LinkedIn-related data access, uncontrolled dependency upgrades increase operational and security risk because HTTP client behavior directly affects outbound requests, auth handling, redirects, and TLS behavior.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196