LinkedIn 人员教育背景查询，按人员 ID 从 LinkedIn 数据获取含院校、学位、专业与绩点的教育经历。帮助招聘人员、HR团队与用人经理核验学历背景、评估候选人资质、做出明智招聘决策——适合候选人筛选、背景核验与人才评估。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:35 AM UTC
• Version: 1.0.3

Overview

This is a disclosed paid API wrapper for LinkedIn education lookup, with expected account and billing helpers that require user-directed confirmation.

Install only if you are comfortable using Upkuajing's paid API service, storing an API key in ~/.upkuajing/.env, and having the skill contact Upkuajing for lookups, account support, optional error reports, and version checks. Confirm paid queries and recharge links deliberately, and do not approve error reports that include secrets or unnecessary personal data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while its documented behavior clearly includes reading environment secrets, writing to ~/.upkuajing/.env, and making networked/account-management requests. This hidden capability expansion reduces informed consent and makes it easier for an agent to access credentials or trigger external actions beyond the user’s expected education-query workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is LinkedIn education lookup, but the documented behavior also includes API key provisioning, local credential storage, balance checks, payment order creation, pricing queries, version checks, local logging, and exception reporting. This mismatch is dangerous because users may authorize a seemingly narrow data-retrieval skill that can also perform billing, credential, and telemetry operations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill instructs the agent to apply for new API keys, persist them locally, create recharge orders, and send payment links, which are account and spending actions outside the core education-query function. Even with some user-confirmation language, bundling these capabilities into the same skill increases the chance of unauthorized purchases, account changes, or confusing privilege escalation.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The exception-reporting feature can transmit request metadata such as request path, request ID, and contextual failure details to the platform, which is not strictly necessary for returning education results. In this skill context the feature appears operational rather than malicious, but it still expands outbound data sharing and could leak sensitive query context if overused or insufficiently sanitized.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements account management, API key issuance, balance queries, and recharge flows that are materially unrelated to the declared skill purpose of retrieving LinkedIn education history. Such hidden or over-broad capabilities increase the attack surface and can enable unauthorized billing, account linkage, or platform abuse under the guise of a different skill. The mismatch between declared purpose and actual capabilities makes the skill context more dangerous because users and reviewers may not expect financial/account operations here.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The presence of recharge-order creation and pricing-query operations is inconsistent with the stated educational-profile retrieval use case and introduces payment-related functionality into an unrelated skill. If exposed through an agent workflow, these actions could trigger unwanted purchases, billing reconnaissance, or monetization abuse. In this context, hidden payment features are more dangerous because they are unexpected and not justified by the user-facing description.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This code can request a new API key and persist it locally, even though the skill description does not establish why credential lifecycle management is necessary here. Unnecessary credential issuance and storage increase the risk of secret sprawl, misuse, and hidden external account binding. The context makes this more concerning because users invoking a profile-enrichment skill would not reasonably expect local credential provisioning behavior.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file’s behavior is materially unrelated to the declared skill purpose: instead of retrieving LinkedIn education data, it implements generic exception reporting to a platform endpoint. This kind of capability mismatch is risky because hidden or undocumented behavior can exfiltrate operational data and undermines user trust and reviewability, even if the code is not overtly malicious.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The function collects and uploads telemetry fields including requestId, requestPath, and free-form context, but this capability is not justified by the stated education-profile retrieval use case. In practice, exception context often contains sensitive prompts, identifiers, or response fragments, so undocumented telemetry can leak internal or user data to the platform.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This module performs outbound network communication and writes a local cache file even though the stated skill purpose is LinkedIn education retrieval. That creates undisclosed side effects, expands the attack surface, and introduces a data flow to a remote service that is not necessary for the core business function. In a skill context, unrelated telemetry/update behavior is security-relevant because it can bypass user expectations and enterprise controls.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code includes self-update/version telemetry capability that is unrelated to the declared LinkedIn education data retrieval purpose. Even though only the skill name is sent, this still leaks environment/tooling metadata to a server and can be used for inventorying deployed skills without user awareness. The mismatch between stated purpose and behavior makes this more concerning in a data-accessing skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends the provided context directly over the network via the error-report API without any visible redaction, sensitivity checks, or user-facing disclosure. Because error context commonly includes stack traces, request contents, tokens, or personal data, this creates a realistic data-leakage path if upstream callers pass rich diagnostic text.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The module automatically sends the skill name to a remote API during version checking without any user-facing notice or consent mechanism shown here. Silent outbound requests can violate privacy expectations, trigger compliance issues, and reveal installed capabilities or operational details in managed environments. In this skill context, such nonessential telemetry is more dangerous because the skill already handles profile-related data and should minimize hidden communications.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill explicitly instructs reading ~/.upkuajing/.env for UPKUAJING_API_KEY and writing newly issued keys back into that file. Accessing and modifying local credential stores is sensitive because it enables secret exposure, persistence of newly acquired credentials, and cross-session reuse beyond the narrow task of querying education history.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 96% confidence
• Finding: The documented flow again directs the agent to inspect a local .env file and, if missing, obtain and automatically save a new API key there. This combines credential discovery, credential issuance, and persistent storage in one workflow, increasing the risk of unauthorized secret handling and unintended account linkage.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 78% confidence
• Finding: The script reads an existing .env file and parses out the API key, then includes a masked prefix of that key in a user-facing message. Even partial secret disclosure and ad hoc secret handling increase exposure risk, especially if output is logged or captured by other systems. In this skill context, local secret inspection is more dangerous because it is unrelated to the advertised data-retrieval purpose.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 89% confidence
• Finding: The code writes a newly issued API key directly into a plaintext .env file under the user's home-managed application directory. Plaintext credential persistence can lead to secret compromise through weak filesystem permissions, backups, accidental commits, or local malware. Because this skill is not primarily an authentication-management tool, embedding secret storage here broadens risk unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is only lower-bounded (httpx>=0.23.0), which permits installation of any future major or minor release. This can introduce unreviewed breaking changes or newly introduced supply-chain risk into the skill at install time, reducing reproducibility and making security posture dependent on the package index state.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 83% confidence
• Finding: Using require_auth=False for the credential-creation request establishes an unsafe default for a sensitive operation. Sensitive account and credential lifecycle actions should default to authenticated, least-privilege access; disabling auth raises the likelihood of unauthorized use if surrounding controls fail. The mismatch with the skill's stated purpose increases concern because users do not expect open auth-management behavior in this component.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 83% confidence
• Finding: Using require_auth=False for the credential-creation request establishes an unsafe default for a sensitive operation. Sensitive account and credential lifecycle actions should default to authenticated, least-privilege access; disabling auth raises the likelihood of unauthorized use if surrounding controls fail. The mismatch with the skill's stated purpose increases concern because users do not expect open auth-management behavior in this component.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196