Uncovering LinkedIn colleagues, locating colleagues and team members from LinkedIn data bycompany ID and personnel ID. Helping recruiters, sales teams, and B2B lead-generationspecialists discover team networks, map organizational relationships, and expand contactlists—suitable for network expansion, background research, and account intelligence.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 1.0.5

Overview

The skill performs the advertised LinkedIn colleague lookup, but it also handles paid-account credentials, top-up orders, and telemetry in ways users should review before installing.

Review this before installing if you are comfortable using a paid UpKuaJing API for LinkedIn colleague data. Avoid printing or sharing ~/.upkuajing/.env, prefer setting the API key through a safer secret mechanism, confirm every paid query or top-up action explicitly, and consider the privacy/legal basis for sales outreach or contact expansion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39

Finding

Credential File Contents Exposed Through Unsafe Setup Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:68

Finding

API Key File Is Written Without Enforced Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Dependency Version Allows Unreviewed Future Releases

Content

View full analysis

=0.23.0 ``` The installation instruction that activates this dependency resolution appears at `SKILL.md:22`: ```markdown 2. **Install dependencies**: `pip install -r requirements.txt` ``` ### Technical Analysis The requirement defines a minimum version but no reviewed upper bound, exact version, or integrity hash. Every installation can therefore resolve to a different future `httpx` release and different transitive dependency versions. No evidence indicates that `httpx` is a typo-squatted package or currently malicious. The risk arises from allowing unreviewed future package content and unconstrained transitive dependencies into a process that handles an API credential and authenticated network traffic. Package installation and import execute code in the user's environment. A compromised upstream release, compromised dependency, or unexpectedly incompatible future version could access environment variables, read the credential file, alter request destinations, or intercept request and response data. ### Attack Path 1. The user follows the documented `pip install -r requirements.txt` instruction. 2. The package resolver selects the latest version satisfying `httpx>=0.23.0`, together with current transitive dependencies. 3. A selected future release is compromised or contains a security regression. 4. Package installation or import executes the affected code in the Skill's Python environment. 5. The dependency accesses `UPKUAJING_API_KEY`, intercepts authenticated traffic, or performs other actions with the invoking user's privileges. ### Impact Assessment A malicious dependency executes with the same operating-system privileges as the Skill. It could read accessible files and environment variables, including the UpKuaJing API key, observe collea ...[truncated 290 chars]

Remediation

View remediation

other

Note

• Location: scripts/common.py:194

Finding

Automatic Version Check Sends Undisclosed Usage Metadata

Content

View full analysis

Dict[str, Any]: """ 向跨境魔方API发起HTTP请求。 """ # 版本检测 check_and_notify(API_BASE_URL) if require_auth and api_key is None: api_key = get_api_key() url = f"{API_BASE_URL}{endpoint}" ``` The metadata transmission is implemented at `scripts/version_check.py:94-103`: ```python def check_skill_version(skill_name: str, api_base_url: str) -> Optional[str]: """调用 API 检查最新版本""" try: url = f"{api_base_url}/agent/api/skills/version" headers = {"Content-Type": "application/json"} with httpx.Client(timeout=10.0) as client: response = client.post(url, json={"name": skill_name}, headers=headers) response.raise_for_status() ``` The transmitted name is derived from the installation directory at `scripts/version_check.py:55-57`: ```python def get_skill_name() -> str: """获取当前 skill 的名称（从目录名）""" return os.path.basename(SKILL_BASE_DIR) ``` ### Technical Analysis Every ordinary call through `make_request` invokes a version check before the requested API operation. Up to once per day, this sends the basename of the local installation directory to `https://openapi.upkuajing.com/agent/api/skills/version`. The endpoint is fixed and uses HTTPS, and the response is used only to display an update notification. The code does not download or execute a remote update. Nevertheless, the extra request and directory-derived metadata are not disclosed in `SKILL.md`, and users are not provided an opt-out. Using the local directory basename instead of the declared Skill identifier can unintentionally reveal customized installation naming co ...[truncated 1028 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrowly framed as LinkedIn colleague lookup, but the documentation also instructs the agent to create API keys, manage account state, retrieve pricing, create top-up orders, and store credentials locally. This mismatch is dangerous because users may authorize a simple lookup skill without realizing it can perform account-management and billing-adjacent actions with broader security and financial implications.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrowly framed as LinkedIn colleague lookup, but the documentation also instructs the agent to create API keys, manage account state, retrieve pricing, create top-up orders, and store credentials locally. This mismatch is dangerous because users may authorize a simple lookup skill without realizing it can perform account-management and billing-adjacent actions with broader security and financial implications.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrowly framed as LinkedIn colleague lookup, but the documentation also instructs the agent to create API keys, manage account state, retrieve pricing, create top-up orders, and store credentials locally. This mismatch is dangerous because users may authorize a simple lookup skill without realizing it can perform account-management and billing-adjacent actions with broader security and financial implications.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is narrowly framed as LinkedIn colleague lookup, but the documentation also instructs the agent to create API keys, manage account state, retrieve pricing, create top-up orders, and store credentials locally. This mismatch is dangerous because users may authorize a simple lookup skill without realizing it can perform account-management and billing-adjacent actions with broader security and financial implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly supports sales outreach and contact expansion using colleague and organizational data, creating a significant privacy and misuse risk. In context, this is more dangerous because the skill is designed to operationalize personal/professional relationship data for prospecting rather than a narrowly necessary business function.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The documentation instructs reading the entire ~/.upkuajing/.env file with cat to obtain an API key. That exposes secrets unnecessarily and may reveal additional credentials stored in the same file, enabling account compromise or misuse of paid API access.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash

cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill tells the agent to have users manually add API keys to a local .env file and to auto-save newly created keys there. Storing and manipulating long-lived credentials in plaintext local files raises theft and persistence risks, particularly in multi-tool or shared environments.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The repeated instruction to inspect ~/.upkuajing/.env for credential presence encourages broad file access to secret material instead of a minimal existence check. In this skill context, that is especially dangerous because the same workflow also includes networked account and billing actions, so stolen credentials can immediately be abused.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements API-key issuance, account lookup, recharge, and pricing functions for a third-party platform, which does not align with the declared LinkedIn colleague discovery purpose. Capability mismatch is dangerous because it can conceal undeclared data flows, billing behavior, or external service dependence under an unrelated skill label, reducing informed user consent and review effectiveness.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The code reads the local .env file and, if an API key exists, includes the first 10 characters of that secret in a returned message. Even partial secret disclosure increases credential exposure risk through logs, terminal history, screenshots, or higher-level wrappers that capture stdout/stderr.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Recharge-order creation and pricing retrieval are monetization/account-management features unrelated to LinkedIn colleague lookup. In this context, they create hidden financial interaction surfaces that could trigger unexpected charges, obscure third-party dependencies, or facilitate abuse through a misleadingly labeled skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The utility module is wired to an unrelated third-party API (openapi.upkuajing.com) and generic persistence features rather than the manifest’s stated LinkedIn colleague-lookup behavior. This mismatch is dangerous because it indicates scope drift or repurposed code that can transmit user-supplied data to an undisclosed external service, undermining user expectations and creating data exfiltration/privacy risk in a skill intended for LinkedIn/account-intelligence workflows.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for finding LinkedIn colleagues, mapping organizational structures, and gathering B2B contacts. This file instead collects runtime metadata and context and sends an exception report to a platform endpoint, which is operational telemetry behavior rather than colleague lookup or account intelligence functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool restrictions while its documented behavior requires reading environment secrets, accessing local files, writing to user storage, and making network calls. In an agent environment, missing scope boundaries increases the chance the skill can access more data or capabilities than users expect, especially because it handles credentials and paid external operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to activate on generic research or account-intelligence requests, which can cause the agent to invoke a credentialed, fee-incurring external lookup more often than intended. Overbroad triggering is especially risky here because the skill can access personal colleague data and initiate paid API operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documentation includes credential acquisition, local secret storage, account information retrieval, and payment/top-up flows that go beyond a simple colleague search. Expanding the operational surface in one skill increases risk of unauthorized billing actions, unsafe secret handling, and user confusion about what the agent may do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This API reference explicitly documents retrieval of a person's colleague information for account intelligence and outreach, but provides no privacy notice, lawful-use constraints, access-control expectations, or handling requirements for personal data. In the context of a skill designed for internal team discovery and contact expansion, that omission increases the risk of misuse for unauthorized profiling, social graph mapping, and privacy-invasive sales targeting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The API documentation explicitly allows reporting raw request parameters, response data, and exception context, which commonly contain secrets, personal data, internal identifiers, or stack traces. Even though it says sensitive fields will be automatically redacted, it does not define the redaction scope or instruct callers to minimize what they send, creating a realistic risk of privacy leakage and exposure of internal system details through telemetry.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60