Retrieving LinkedIn personnel educational background queries, fetching educationalexperiences containing institutions, degrees, majors, and GPAs from LinkedIn data bypersonnel ID. Helping recruiters, HR teams, and hiring managers verify educationalbackgrounds, assess candidate qualifications, and make smart hiring decisions—suitable forcandidate screening, background verification, and talent assessment.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:36 AM UTC
• Version: 1.0.3

Overview

This skill performs the advertised education lookup, but it also handles paid account setup, local API-key storage, top-up flows, and sensitive background-check data with incomplete privacy and scoping safeguards.

Install only if you are comfortable giving this skill access to an UpKuaJing API key, querying LinkedIn-sourced education data for background-check purposes, and using its paid account/top-up support flows. Use it only with proper authorization for the person being checked, avoid placing sensitive context in error reports, and protect or rotate any API key stored in ~/.upkuajing/.env.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill uses environment variables, local file access to ~/.upkuajing/.env, network calls, and writes state such as API keys, but declares no explicit permissions or trust boundaries. This creates a transparency and policy-enforcement gap: an agent or reviewer may authorize the skill for a narrow education lookup while the skill can also access credentials, persist data locally, and initiate external requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a background-check education verification tool, but the documented behavior extends to API key provisioning, account/balance lookup, top-up order creation, pricing queries, and error reporting to a third-party platform. This mismatch can mislead users into consenting to broader account-management, billing, and data-sharing actions than expected, especially in a sensitive HR screening context.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file implements account-management and billing functions such as API key provisioning, account balance lookup, recharge order creation, and pricing queries, which are materially unrelated to the advertised LinkedIn education verification purpose. In a background-check skill, these hidden platform-management capabilities expand the attack surface and could enable unauthorized account manipulation or monetization under the guise of a benign HR workflow.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The ability to create recharge or payment orders is unjustified for an education-verification skill and introduces direct financial risk. If exposed through the agent or invoked unexpectedly, it could initiate unwanted billing flows or facilitate abuse of the linked platform account.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script provisions a new platform API key and stores it locally in a .env file, which exceeds the stated need of verifying education records. Bundling credential lifecycle management into an unrelated skill increases the chance of secret sprawl, misuse, and unintended privilege delegation.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: This file implements a platform error-reporting function that is unrelated to the stated purpose of LinkedIn-sourced education verification. In a background-check skill, transmitting request metadata and free-form context to a separate endpoint creates an undocumented secondary data flow that could expose candidate or system information beyond what users would reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The network call to '/agent/skill/error/report' gives the skill an additional outbound reporting capability not justified by its declared education-checking function. Extra platform-communication paths expand the attack surface and can be used to exfiltrate operational or user-related context under the guise of diagnostics.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This module adds behavior outside the skill’s stated purpose by making outbound network requests and persisting local state in a hidden home-directory cache. Even though it only transmits the skill name, this creates an undisclosed telemetry/update channel and file-system side effects that can violate least-privilege expectations and expand the attack surface if the base URL is untrusted or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Remote version discovery is not necessary to perform LinkedIn education verification, so it represents unnecessary capability and additional attack surface. While this code does not self-update, it still establishes a control/telemetry path to a remote service that could be abused for tracking, dependency confusion, or future unsafe update workflows.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad and ambiguous for a skill handling sensitive education background information, making accidental or overly broad activation more likely. In an agent setting, vague triggers can cause the skill to run in contexts where the user did not intend a background-check workflow, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill supports querying and evaluating personal education records for hiring and background checks but does not provide a clear privacy, consent, or lawful-use warning. Because the context is employment screening and personal data, the absence of safeguards raises the chance of misuse, unlawful processing, or overcollection of sensitive personal information.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly instructs agents to report request parameters, response data, and error context to a remote API, which can include personal or sensitive operational data. Although it mentions automatic masking for sensitive fields, it does not define what is masked, require data minimization, or warn users/operators about privacy implications, creating a realistic risk of over-collection and unintended disclosure during error reporting.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function forwards a caller-supplied 'context' field plus request identifiers to a remote endpoint without any visible sanitization, minimization, or user-facing disclosure. In this skill context, that context could include applicant data, internal request paths, or other sensitive troubleshooting details, causing unintended privacy or compliance exposure.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code sends the skill name to a remote endpoint without any visible disclosure or consent mechanism in the module. In a background-check skill, undisclosed outbound metadata sharing is more sensitive because operators may expect strict handling of employment-related workflows and minimal external data exposure.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs checking and populating ~/.upkuajing/.env for UPKUAJING_API_KEY and can automatically apply for and save a new key locally. Accessing and modifying credential files is dangerous because it exposes secrets handling to the skill workflow and may lead to unauthorized credential discovery, persistence, or leakage through prompts, logs, or overly broad file access.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 94% confidence
• Finding: This section continues the credential-handling flow by directing the agent to inspect ~/.upkuajing/.env and potentially trigger auth.py --new_key, which persists credentials automatically. In combination with networked account actions and local file writes, this increases the risk of secret exposure and unintended account enrollment or modification beyond the user's original request.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

• Confidence: 88% confidence
• Finding: This code path centers on detecting and handling a local .env file containing an API key, indicating credential material is managed in a plaintext local file. Storing and managing secrets this way raises the risk of accidental disclosure through filesystem access, backups, or developer tooling.

Credential Access

High

• Category: Privilege Escalation

Content

env_file = UPKUAJING_ENV_FILE

    if env_file.exists():
        # 读取现有的 .env 文件
        try:
            with open(env_file, 'r', encoding='utf-8') as f:
                content = f.read()

• Confidence: 90% confidence
• Finding: Reading a .env file to retrieve an existing API key confirms the skill depends on locally persisted secrets in plaintext form. In the context of an education-checking skill, this credential-handling behavior is unnecessary and increases the likelihood of unauthorized access if the host is shared or compromised.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 96% confidence
• Finding: Writing a freshly issued API key directly into a .env file persists a sensitive credential in plaintext on disk. If the file permissions are weak, the machine is multi-user, or the directory is synced or backed up, the credential can be exposed and used to access the platform account or related APIs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`httpx>=0.23.0`), which allows installation of any newer version, including releases with breaking changes or newly introduced supply-chain risk. While not an immediate exploit by itself, unpinned dependencies reduce build reproducibility and can cause the skill to pull unexpected package versions during deployment or later rebuilds.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: This finding is substantively the same unsafe default: the code deliberately disables authentication for the key-creation request. In this skill context, that behavior is more suspicious because the advertised function is academic verification, not account bootstrap or platform credential issuance.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: This finding is substantively the same unsafe default: the code deliberately disables authentication for the key-creation request. In this skill context, that behavior is more suspicious because the advertised function is academic verification, not account bootstrap or platform credential issuance.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58