Uncovering LinkedIn colleagues, locating colleagues and team members from LinkedIn data bycompany ID and personnel ID. Helping recruiters, sales teams, and B2B lead-generationspecialists discover team networks, map organizational relationships, and expand contactlists—suitable for network expansion, background research, and account intelligence.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:34 AM UTC
• Version: 1.0.5

Overview

This is a disclosed paid UpKuaJing LinkedIn colleague lookup skill, with sensitive but purpose-aligned API key, billing, and reporting flows users should handle carefully.

Install only if you are comfortable using UpKuaJing as the external provider, storing an API key under ~/.upkuajing/.env, and paying per API call. Confirm costs before running queries or top-up flows, and do not send sensitive internal details when using the optional error-reporting command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill uses sensitive capabilities including environment-variable access, local file read/write, and outbound network access, but does not declare permissions or narrowly scope them. This undermines user and platform visibility into what the skill can do, making credential access, data exfiltration, or unintended local state changes harder to audit and control.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is a LinkedIn colleague lookup, but the documented behavior also includes credential provisioning, local credential storage, billing/top-up operations, account inspection, error reporting, and version-checking. This mismatch is dangerous because users may invoke the skill expecting a narrow lookup function while the skill performs additional account and network actions with financial, privacy, and telemetry implications.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file implements API key provisioning, account lookup, recharge-order creation, and pricing retrieval for an external service, which does not match the declared LinkedIn colleague-discovery purpose. This kind of scope mismatch is dangerous because it can conceal undeclared external dependencies, billing actions, and data flows that users would not reasonably expect from the skill metadata.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Creating a recharge order is unrelated to LinkedIn colleague lookup and introduces a financial side effect not implied by the skill description. Hidden or unjustified payment flows increase the risk of unauthorized charges, user deception, and misuse of agent permissions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Account balance and API pricing retrieval are unrelated to the stated research use case and expose financial/account-management capabilities beyond expected scope. This broadens the attack surface and may reveal sensitive commercial metadata or facilitate undisclosed monetization behavior.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The helper is wired to an unrelated third-party API domain and product namespace ('跨境魔方') even though the skill is presented as a LinkedIn colleague lookup utility. This mismatch is dangerous because users may provide LinkedIn/account-intelligence inputs that are silently sent to an unexpected external service, creating undisclosed data exfiltration and supply-chain risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module adds outbound network communication and persistent local version-cache behavior that is unrelated to the stated LinkedIn colleague discovery purpose. Unnecessary side-channel networking increases attack surface, can leak skill presence/usage metadata to a remote service, and creates hidden behavior users may not expect from a research/enrichment skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill performs a self-version check by POSTing the skill name to a remote API and surfacing upgrade instructions, despite this behavior having no direct relation to LinkedIn research. In the context of a data-gathering skill, hidden update-check behavior is more suspicious because it introduces covert communications and could be repurposed for telemetry, tracking, or remote control patterns.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document instructs agents to send request parameters, response data, and exception context to an external reporting API, which can include sensitive operational or personal data. Although it mentions automatic masking of sensitive fields, it does not define what is masked, require minimization, or provide a clear warning/consent boundary, so users may unintentionally exfiltrate internal data during debugging.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code can log full request parameters and API responses to local files, which may include personal data, search inputs, internal company identifiers, and potentially sensitive response content. Even though logging is disabled by default, enabling it creates quiet local data retention without user-facing notice, increasing privacy, insider-access, and compliance risk in a contact-intelligence context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code sends a caller-provided `context` field and request metadata to a remote `/agent/skill/error/report` endpoint without any minimization, redaction, or visible consent mechanism. In a skill handling account intelligence and internal colleague discovery, error context could easily contain personal data, internal identifiers, request paths, or operational details, creating a meaningful data-leakage risk.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The script sends company and person identifiers to an external API endpoint to retrieve colleague data, but it provides no user-facing notice, consent prompt, or privacy warning that potentially sensitive LinkedIn-related identifiers are being transmitted off-platform. In a skill explicitly designed for colleague discovery, account intelligence, and sales outreach, this increases privacy and compliance risk because operators may unknowingly use personal or organizational data in ways that violate internal policy, platform terms, or data-handling expectations.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs checking and using a credential file in ~/.upkuajing/.env and supports automatically creating and storing a new API key there. Accessing and modifying a shared local secret store increases the risk of credential disclosure, accidental overwrite, unauthorized reuse by other tools, and persistence of sensitive secrets beyond the immediate task.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: This section continues the same behavior: the skill is directed to inspect a local .env file and potentially persist newly issued API credentials to it automatically. In context, the skill is not just consuming a token but managing secrets on disk, which materially expands the attack surface for credential theft and misuse.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including releases with breaking changes or newly introduced vulnerabilities. This weakens supply-chain control and makes builds non-reproducible, increasing the chance that the skill pulls an unsafe or incompatible package version over time.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:60