ClawHub
Back to skill

Security audit

Retrieving LinkedIn personnel educational background queries, fetching educationalexperiences containing institutions, degrees, majors, and GPAs from LinkedIn data bypersonnel ID. Helping recruiters, HR teams, and hiring managers verify educationalbackgrounds, assess candidate qualifications, and make smart hiring decisions—suitable forcandidate screening, background verification, and talent assessment.

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform paid LinkedIn education lookups, but its privacy, billing, and credential-handling details need careful review before installation.

Install only if you are authorized to run background-check style education lookups, understand that queries are sent to UpKuaJing and may incur fees, and are comfortable managing a plaintext API key on disk. Do not run commands that print the API key into chat or logs; use a secret manager or restricted file permissions and rotate any key that was exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

API Key Disclosure Through Documented Credential File Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37-46
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Code

markdown
This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Example file content:

text
UPKUAJING_API_KEY=your_api_key_here

API Key Not Set

First check if the ~/.upkuajing/.env file has UPKUAJING_API_KEY;

text

### Technical Analysis

The documented `cat ~/.upkuajing/.env` command prints the complete contents of the credential file. Because the file contains the API key in plaintext, following this instruction exposes the secret through standard output.

Checking whether the required variable exists does not require displaying its value. The instruction therefore exceeds the minimum access and disclosure needed for the Skill's declared functionality. Output may be captured in an Agent transcript, terminal log, screen recording, screenshot, or other monitoring system.

No evidence was found that the Skill intentionally sends the key to an unrelated service. The vulnerability is the unnecessary disclosure caused by the documented inspection procedure.

### Attack Path

1. A user or Agent follows the documented API-key troubleshooting procedure.
2. The command prints the complete `UPKUAJING_API_KEY` value.
3. The output is retained in a conversation transcript, terminal capture, diagnostic log, screenshot, or other accessible channel.
4. An unauthorized party obtains the exposed key.
5. The party submits authenticated requests to the UpKuaJing API using the compromised credential.

### Impact Assessment

An attacker who obtains the key may perform operations authorized by the associated UpKuaJing account, including paid API queries and supported account-related API actions. This can cause unauthorized charges, balance depletion, exposure of data available through the
...[truncated 250 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to print the entire credential file.
  • Check only whether the required variable is present, without displaying its value.
  • If status output is necessary, return only a Boolean result such as “API key configured.”
  • Redact secrets from Agent responses, terminal output, diagnostic reports, and examples.
  • Advise users to rotate the key immediately if it has appeared in a transcript or log.
  • Prefer the process environment or a dedicated secret manager over manual credential-file inspection.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:70
Finding

API Key File Is Created Without Explicit Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py:70-73
Vulnerability Type: Insecure plaintext secret storage permissions
Risk Level: Medium

Vulnerable Code

python
# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

The newly issued API key is written in plaintext using the default permissions selected by the operating system and current process umask. The code does not explicitly create the ~/.upkuajing directory with owner-only permissions, create the .env file with mode 0600, or verify permissions on an existing file.

On a system with a permissive umask or an existing file with broad permissions, other local users may be able to read the API key. Opening an existing file with mode w truncates it but generally preserves its existing permissions, so previously unsafe permissions can remain in effect.

Storing a credential in a dedicated file is compatible with the Skill's functionality, but permitting its accessibility to depend entirely on ambient host configuration does not adequately enforce least privilege.

Attack Path

  1. A user runs auth.py --new_key on a shared system or under a permissive umask, or an overly permissive .env file already exists.
  2. The script writes the newly issued API key to ~/.upkuajing/.env.
  3. The resulting file remains readable by unintended local users.
  4. Another local account reads the plaintext key.
  5. The attacker reuses the key for authenticated and potentially billable UpKuaJing API operations.

Impact Assessment

Exploitation grants access to the API authority represented by the stolen key. Potential consequences include unauthorized paid requests, depletion of account balance, access to API-returned information, and actions being incorrectly attributed to the legitimate account holder.

This issue does not itself provide privilege e ...[truncated 214 chars]

Remediation
View remediation

Remediation Suggestions

  • Create ~/.upkuajing with owner-only mode 0700.
  • Create the credential file atomically with mode 0600, rather than relying on the process umask.
  • Verify and repair permissions on existing directories and credential files before reading or writing them.
  • Consider writing to a securely created temporary file, flushing it, and atomically replacing the destination.
  • Reject symbolic-link destinations or otherwise protect against unsafe pre-existing path objects where the execution environment may be untrusted.
  • Prefer an operating-system credential store or secret manager when available.
  • Document a key-rotation procedure for credentials that may have been stored with unsafe permissions.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Version Allows Unreviewed Future Releases

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned dependency and non-reproducible installation
Risk Level: Low

Vulnerable Code

text
httpx>=0.23.0

The associated installation instruction in SKILL.md:19 is:

markdown
2. **Install dependencies**: `pip install -r requirements.txt`

Technical Analysis

The lower-bound-only requirement permits package resolution to select any future httpx release. The project provides neither an exact version pin nor package hashes. Consequently, two installations performed at different times can install materially different dependency code without any change to the reviewed Skill.

This does not establish that the current httpx package is malicious. The risk is that a compromised, malicious, or incompatible future release could be installed automatically. Because the dependency is imported by request-handling code, an unsafe release would execute in the Skill process and could access its environment, API key, files available to that process, and network connectivity.

Attack Path

  1. A user follows the documented pip install -r requirements.txt instruction.
  2. Package resolution selects an unreviewed future release satisfying the lower bound.
  3. The selected package or its dependency chain has been compromised, maliciously modified, or contains a security-relevant regression.
  4. Package-controlled code executes during installation or when imported by the Skill.
  5. The compromised code acts with the permissions of the user running the installation or Skill, potentially accessing the API key and other process-accessible resources.

Impact Assessment

If the supply-chain condition occurs, malicious dependency code could run with the invoking user's privileges. Its potential scope includes reading environment variables and accessible files, capturing the API key, changing API requests or responses, a ...[truncated 247 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin httpx and all transitive dependencies to reviewed exact versions.
  • Generate and maintain a lock file for reproducible installations.
  • Record cryptographic hashes and install with hash verification, such as pip install --require-hashes -r requirements.txt.
  • Use an automated dependency update process that runs security scanning and tests before accepting new versions.
  • Review dependency provenance and retrieve packages only from trusted package indexes.
  • Periodically update pinned versions after reviewing security advisories, rather than allowing automatic adoption of all future releases.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill documentation indicates additional behaviors such as remote version checks, local cache writes, and metadata parsing that are unrelated to the declared academic-record lookup purpose. These hidden support functions broaden data flows and execution surface, which is risky when the skill is used in a sensitive personnel-screening context.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill documentation indicates additional behaviors such as remote version checks, local cache writes, and metadata parsing that are unrelated to the declared academic-record lookup purpose. These hidden support functions broaden data flows and execution surface, which is risky when the skill is used in a sensitive personnel-screening context.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill documentation indicates additional behaviors such as remote version checks, local cache writes, and metadata parsing that are unrelated to the declared academic-record lookup purpose. These hidden support functions broaden data flows and execution surface, which is risky when the skill is used in a sensitive personnel-screening context.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill documentation indicates additional behaviors such as remote version checks, local cache writes, and metadata parsing that are unrelated to the declared academic-record lookup purpose. These hidden support functions broaden data flows and execution surface, which is risky when the skill is used in a sensitive personnel-screening context.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill documentation indicates additional behaviors such as remote version checks, local cache writes, and metadata parsing that are unrelated to the declared academic-record lookup purpose. These hidden support functions broaden data flows and execution surface, which is risky when the skill is used in a sensitive personnel-screening context.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The documentation instructs reading a local ~/.upkuajing/.env file containing an API key, which is direct credential access. In an agent setting, exposing or handling secrets through general-purpose file reads raises the risk of credential leakage, reuse outside intended scope, or accidental disclosure in logs and outputs.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash
cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill explicitly tells the agent to check for and potentially create credentials in ~/.upkuajing/.env, including automatically saving a newly issued API key. Writing long-lived secrets to the local filesystem expands attack surface and can leave credentials accessible to other tools, sessions, or users on the host.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The workflow combines credential presence checks with instructions for storing user-provided or newly generated API keys in a local .env file. In a sensitive skill that also performs external queries and account actions, this materially increases the risk of secret theft, misuse, and unauthorized billing or API access.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements account and billing management for an unrelated third-party service rather than LinkedIn education verification. This mismatch is dangerous because it expands the skill’s capabilities beyond its declared purpose, increasing the chance of undisclosed data flows, unauthorized account operations, or deceptive packaging of hidden functionality.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

The code reads an existing .env file containing API credentials and later surfaces part of the secret in a user-facing message. In a skill whose declared purpose is unrelated to credential management, unnecessary access to secret files increases the risk of disclosure and normalizes sensitive-file handling outside a justified context.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The code writes a newly issued API key to a local .env file, creating persistent plaintext credential storage. Plaintext secrets on disk are vulnerable to accidental disclosure, backup leakage, local compromise, and misuse by other processes or users on the same host.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Creating recharge orders and exposing pricing endpoints has no clear relationship to applicant education checks. In a background-screening skill, hidden monetization and payment operations are especially risky because they can trigger unauthorized financial actions or conceal the true operational purpose of the package.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring states that the script reports Agent/Skill invocation exceptions to a platform for tracking and optimization, and the function docstring repeats that intent. That documented behavior contradicts the manifest's claim that the skill checks LinkedIn education history and confirms academic details for screening.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a skill for checking LinkedIn-sourced education history by personnel ID, including confirming degrees, majors, and GPA data. In contrast, this code validates error-report parameters and sends them to '/agent/skill/error/report', which is operational telemetry unrelated to education background checks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior includes network access, reading local credential files, and writing local state. In an agent environment, that mismatch increases the chance of overbroad execution, unintended credential exposure, and unsafe filesystem or network actions without clear sandboxing expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger language is broad and ambiguous for a sensitive background-check capability, increasing the chance that the skill is invoked in contexts where the user has not clearly requested transmission of personal education data. For screening-related workflows, loose activation criteria can lead to privacy-invasive or unjustified lookups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill handles a person's LinkedIn-sourced education data for hiring and evaluation but does not include a privacy warning or explain data transmission to a third-party platform. Because the context is pre-employment screening, the absence of transparency and consent language makes the data handling substantially more dangerous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Including account creation, top-up, and payment-order guidance inside a skill framed as an education lookup creates unnecessary financial-operation capability and social-engineering surface. In practice, it can steer users into billing actions unrelated to the narrow data-retrieval task they intended to perform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file presents its purpose and CLI help text exclusively in Chinese, which imposes a specific language on users without offering an alternative or documenting that the skill is intended only for a Chinese-language audience. The policy calls for flagging language or locale constraints when they are forced without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:58