LinkedIn 人员教育背景查询，按人员 ID 从 LinkedIn 数据获取含院校、学位、专业与绩点的教育经历。帮助招聘人员、HR团队与用人经理核验学历背景、评估候选人资质、做出明智招聘决策——适合候选人筛选、背景核验与人才评估。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a disclosed paid LinkedIn education lookup, but its API-key and billing handling create review-worthy risk before installation.

Install only if you are comfortable with a paid third-party API skill that can use and store an UPKUAJING API key, query account balance, and create recharge orders. Do not print the full .env file in chats or logs, confirm any paid query or recharge action separately, and review the provider-facing version check and optional error-reporting data before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Credential Exposure Through Full Secret File Display

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38
Vulnerability Type: Unnecessary disclosure of credential-file contents
Risk Level: Medium

Vulnerable Code

bash

cat ~/.upkuajing/.env

Technical Analysis

The Skill directs the operator or Agent to display the complete contents of the credential file. Verifying whether UPKUAJING_API_KEY is configured does not require revealing its value or printing every entry in the file.

Command output may enter terminal logs, Agent context, conversation transcripts, screen recordings, or command-execution telemetry. If the file contains additional environment variables, those values are exposed as well.

Attack Path

1. The Skill encounters a missing or apparently unavailable API key.
2. The documented diagnostic command is executed.
3. The complete .env file, including the API key and potentially unrelated secrets, is printed.
4. A user with access to logs, transcripts, terminal output, or Agent context obtains the credential.
5. The exposed key is used to make unauthorized or billable API requests.

Impact Assessment

Exploitation can disclose the UPKUAJING_API_KEY and any additional secrets stored in the same file. The resulting access is limited to the privileges associated with the exposed credentials, but may include paid API usage, access to account information, and creation of payment-related requests.

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to print the credential file.
• Check only whether the required variable exists, without returning its value.
• Prefer secret injection through the process environment or a dedicated secret manager.
• If file-based configuration remains supported, implement a helper that parses only UPKUAJING_API_KEY and reports a Boolean configured/not-configured result.
• Ensure diagnostics redact credential values and never include them in Agent responses, logs, or error reports.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:73

Finding

API Key File Created Without Explicit Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py:73-74
Vulnerability Type: Insecure local credential storage
Risk Level: Medium

Vulnerable Code

python

with open(env_file, 'w', encoding='utf-8') as f:
    f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The API key is written to a plaintext file using the default permissions produced by the process umask. The code does not explicitly require owner-only access. In an environment with a permissive umask, the resulting file may be readable by other local users.

The normal open() operation also follows symbolic links. If an attacker can control the target path or pre-create the file as a symbolic link, the operation may overwrite another file writable by the invoking user.

Attack Path

1. A user invokes the new-key operation.
2. The service returns a new API key.
3. The script creates or truncates ~/.upkuajing/.env using inherited permissions and ordinary symlink-following behavior.
4. On a permissively configured system, another local user reads the file; alternatively, an attacker who controls the path may redirect the write through a symbolic link.
5. The attacker uses the recovered API key for unauthorized or billable requests.

Impact Assessment

A local attacker may obtain the API privileges and billing capacity associated with the stored key. The symlink case can additionally overwrite a file writable by the victim process, although it does not grant permission to write files beyond the victim user's existing privileges.

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with owner-only mode 0700.
• Create the credential file atomically with mode 0600, such as through os.open() with restrictive flags and permissions.
• Reject symbolic links using platform-appropriate no-follow behavior.
• Write to a securely created temporary file in the same directory, apply mode 0600, flush it, and atomically replace the destination.
• Verify existing file ownership and permissions before reading or replacing it.
• Consider using the operating system's credential store instead of a plaintext .env file.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Version

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unlocked dependency resolution
Risk Level: Low

Vulnerable Code

text

httpx>=0.23.0

Technical Analysis

The lower-bound-only constraint permits installation of any later httpx release. Consequently, the dependency code installed in the future may differ materially from the version covered by this audit. No integrity hashes or lock file are supplied.

This is not evidence that the current package is malicious. It is a supply-chain hardening weakness because an unreviewed, compromised, or incompatible future release can be selected automatically during installation.

Attack Path

1. The user follows the Skill instruction to install dependencies.
2. The package resolver selects the newest release satisfying the lower-bound constraint.
3. A compromised or otherwise unsafe future release is downloaded from the configured package index.
4. Package code executes during installation or when the Skill imports and uses the dependency.
5. That code runs with the privileges of the user installing or invoking the Skill.

Impact Assessment

A compromised dependency could access files, environment variables, the API key, and network resources available to the invoking user. It would not automatically obtain privileges beyond that operating-system account, but could fully compromise the Skill's execution context.

Remediation

View remediation

Remediation Suggestions

• Pin httpx to a specific reviewed version.
• Generate a lock file containing hashes for the package and all transitive dependencies.
• Install with hash verification enabled.
• Use automated dependency scanning and a controlled update process.
• Re-audit and test dependency updates before changing the locked versions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates undeclared local file access and version-check network activity unrelated to the advertised LinkedIn education-query function. Even if operationally useful, off-purpose file/network behavior creates hidden side effects and can expose local state or enable unexpected data egress.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding indicates undeclared local file access and version-check network activity unrelated to the advertised LinkedIn education-query function. Even if operationally useful, off-purpose file/network behavior creates hidden side effects and can expose local state or enable unexpected data egress.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates undeclared local file access and version-check network activity unrelated to the advertised LinkedIn education-query function. Even if operationally useful, off-purpose file/network behavior creates hidden side effects and can expose local state or enable unexpected data egress.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates undeclared local file access and version-check network activity unrelated to the advertised LinkedIn education-query function. Even if operationally useful, off-purpose file/network behavior creates hidden side effects and can expose local state or enable unexpected data egress.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly instructs reading the entire ~/.upkuajing/.env file via cat, which can expose API keys and potentially other secrets stored alongside them. Directly retrieving raw credential files is dangerous because it normalizes secret disclosure to the agent and increases risk of accidental leakage in outputs, logs, or downstream processing.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The workflow directs the agent to inspect credential storage and potentially provision a new API key that is then automatically saved to ~/.upkuajing/.env. This combines credential discovery with credential creation and persistence, expanding both exposure and the blast radius if the environment or logs are compromised.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Automatic storage of newly obtained API keys into a local .env file creates a persistent credential-handling path inside a skill that is supposed to perform data lookup. Persistent secret writing is risky because permissions, backups, or other tools may later expose the key without the user's awareness.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements authentication, API key provisioning, account balance lookup, recharge order creation, and pricing queries, which materially exceed the declared skill purpose of retrieving LinkedIn education history. This capability mismatch is dangerous because it introduces financial/account-management functions into a data-collection skill, expanding the attack surface and enabling misuse under misleading packaging.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Writing the newly issued API key directly into a plaintext .env file creates a credential exposure risk if filesystem permissions are weak, backups are broad, or other local users/processes can read the file. In this skill context, the danger is increased because the skill already includes unrelated account-management capabilities, so compromise of the stored key could enable broader platform abuse.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The error path encourages manual environment-variable handling after key issuance, which can lead to insecure ad hoc storage or accidental disclosure; combined with the surrounding design, the key is treated as a plaintext secret. More importantly, elsewhere the script exposes part of an existing key in a user-facing message, indicating weak secret-handling hygiene around this credential flow.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Creating recharge/payment orders is unrelated to collecting education history and cannot be justified by the stated skill context. In a mislabeled skill, embedded payment functionality can be abused to trigger unauthorized purchases, confuse operators, or conceal monetization/account actions behind an innocuous description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

技能清单声明该技能用于调取 LinkedIn 平台用户教育履历、分析学历与校友网络，但本文件核心逻辑是收集 skillId、requestId、requestPath、context 等信息并调用 /agent/skill/error/report 上报异常。异常遥测上报并非该技能描述中声明的面向 LinkedIn 教育信息获取的行为，属于明显不同的实际操作。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents capabilities that involve environment access, local file reads/writes, and network operations, but it does not declare any explicit tool scope or allowed-tools boundary. This increases the chance that an agent can exercise broader powers than users expect, especially around credential files and outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill name includes a -zh locale suffix and the description/title/body are entirely in Chinese, with no indication that users may choose another language or that the Chinese-only behavior is a documented regional requirement. This is a natural-language locale policy concern because it implicitly constrains interaction language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Within a skill framed as an education-history lookup, the instructions also authorize new key application, recharge order creation, account inspection, and exception reporting. This scope drift makes the skill more dangerous because users seeking passive lookup may inadvertently trigger account, billing, or data-sharing actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

New API key issuance and recharge-order creation are financially and operationally sensitive capabilities that are not proportionate to a simple education-query skill. Embedding them here increases the chance of accidental charges, unauthorized account changes, or social engineering around payment flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's natural-language instructions and API reference are fully presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate organizational language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing CLI/help text are written only in Chinese, which implies a fixed language experience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196