Pulls professional work-history records from LinkedIn datasets using a personnel-IDlookup. It extracts past employers, job titles together with employment start-and-enddates. Recruiters, hiring managers and sales teams validate career trajectories andevaluate professionals’ backgrounds to screen qualified applicants. This tool works wellfor candidate vetting, pre-employment background checks and overall talent acquisitionworkflows.

• Outcome: Review
• Latest audit: Aug 24, 2026 · 9:38 AM UTC
• Version: 1.0.2

Overview

The skill does perform the advertised LinkedIn work-history lookup, but it bundles sensitive candidate-data access with paid account operations, plaintext API-key storage, and under-scoped error/version reporting.

Review before installing. Use it only if you are authorized to query the person’s employment-history data, are comfortable sending LinkedIn identifiers to UpKuaJing, and accept the paid API/account-management flow. Prefer configuring the API key through a protected secret manager if available, and avoid sending raw candidate data, full responses, tokens, or stack traces in error reports.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (24)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill exposes capabilities to read environment variables, access local files, and make network calls without explicitly declaring those permissions. That weakens user and platform visibility into what the skill can do and increases the chance of unintended credential access or external data transmission during use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a LinkedIn work-history lookup tool, but its documented behavior includes account creation, balance management, payment order generation, pricing retrieval, local credential storage, error reporting, and version-checking. This expands the trust boundary far beyond the stated purpose, creating opportunities for credential handling, billing actions, and data egress that users would not reasonably expect from the description.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Including account provisioning, top-up, and account-info flows inside a background-verification skill introduces unrelated financial and account-management actions into a sensitive data lookup workflow. This increases the chance of accidental billing actions, broader credential exposure, and user confusion about what the skill is authorized to do.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The error-report submission feature sends operational context back to the vendor platform, which is outside the core function of reviewing work history. Even with a confirmation step, this can leak request metadata or user context to a third party if error details contain sensitive identifiers.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements API-key issuance, account info, recharge-order creation, and pricing lookup for an unrelated third-party platform, which does not align with the stated LinkedIn work-history verification purpose. Such scope mismatch is dangerous because it introduces hidden billing and credential-management capabilities into a background-screening skill, increasing the risk of unauthorized external service use, data exfiltration, or deceptive monetization.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Creating recharge/payment orders is unrelated to candidate background verification and gives the skill the ability to trigger monetization flows against an external service. In this context, the mismatch is especially risky because users invoking a hiring-related skill would not reasonably expect payment-order creation behavior, creating potential for abuse, surprise charges, or concealed platform coupling.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Retrieving account balances and platform pricing is not necessary for verifying a candidate's LinkedIn employment history and broadens the skill's access to financial/account metadata. While less severe than direct payment creation, it still exposes unrelated sensitive operational information and signals the skill is acting as a thin wrapper for an external commercial platform rather than its declared purpose.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The module is clearly a generic client for a third-party '跨境魔方' API with authentication, billing, logging, and task storage, which does not match the declared LinkedIn work-history verification purpose. This kind of capability mismatch is dangerous because it can route sensitive candidate data to an unrelated external service and hides materially different behavior from users and reviewers.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file implements persistent local task directories, metadata files, and JSONL result storage, which exceeds the expected read-only/background-check behavior implied by the skill description. Persisting candidate-related lookup data creates unnecessary retention of potentially sensitive employment history and increases exposure if the host or workspace is later accessed by another process or user.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The presence of billing and account-balance handling is unrelated to LinkedIn experience verification and indicates the skill may perform account-affecting actions or rely on a paid third-party service without clear disclosure. In a candidate-screening context, hidden billing-related behavior increases the risk of unauthorized usage of external accounts and deceptive scope expansion.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This module performs outbound network access and writes a persistent cache file even though the skill’s stated purpose is LinkedIn employment verification. That creates hidden side effects, expands the attack surface, and can expose environment or usage metadata to a remote service without being necessary for the user-requested task.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file includes self-update and version-tracking support unrelated to the declared business function of candidate background screening. While not directly exploitative by itself, unnecessary update telemetry and state tracking inside a skill increase complexity and create opportunities for covert signaling or unauthorized behavior over time.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill targets personal employment-history data for background verification and candidate screening but does not include a privacy or sensitivity warning. In this context, lack of disclosure is dangerous because it can normalize collection and use of personal data without prompting the user to consider consent, authorization, or applicable legal restrictions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs agents to send request parameters, response data, and exception context to an error-reporting API, which can easily include personal data, authentication artifacts, or internal system details. Although it claims sensitive fields are automatically redacted, it does not define what is redacted, require minimization, or warn users/operators against including raw LinkedIn lookup results or candidate background data, creating a real risk of privacy leakage and over-collection.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function forwards a caller-supplied `context` field to `/agent/skill/error/report` with no visible sanitization, minimization, or user disclosure. In a background-verification skill, error context may contain personnel identifiers, candidate data, request metadata, or API responses, creating a real risk of unintended sensitive-data exfiltration to a telemetry endpoint.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script sends a person's LinkedIn-related identifier and optionally a company identifier to a remote endpoint for background-check style processing, but this file provides no user-facing notice, consent check, or purpose limitation. In the context of candidate screening and employment verification, these identifiers are personal data and undisclosed transmission increases privacy, compliance, and misuse risk.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The version check sends the skill name to a remote API without any user-facing notice in this file. Even if the payload is small, it leaks metadata about installed or executed skills and can reveal user activity patterns when combined with timing or source information.

Credential Access

High

• Category: Privilege Escalation

Content

### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

• Confidence: 95% confidence
• Finding: The skill instructs reading API keys from a local ~/.upkuajing/.env file and supports automatically applying for and storing new credentials there. In combination with undeclared file and env access, this creates a clear credential-access surface and increases the risk of exposing, misusing, or persisting secrets outside controlled secret-management mechanisms.

Credential Access

High

• Category: Privilege Escalation

Content

First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

• Confidence: 95% confidence
• Finding: The documented flow combines checking for existing credentials, accepting user-provided keys, and auto-saving newly issued keys to a local .env file. That broadens credential exposure and persistence in a skill whose main purpose is data lookup, making secret handling more dangerous in context because the skill also performs networked operations and account actions.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 88% confidence
• Finding: Writing a newly issued API key into a plaintext .env file creates a persistent secret on disk that may be readable by other local users, backup systems, or accidental tooling exposure. In a skill with already suspicious off-purpose billing/auth behavior, plaintext credential persistence increases the chance that hidden external-service access can be reused or stolen.

Credential Access

High

• Category: Privilege Escalation

Content

except IOError as e:
        return {
            "success": False,
            "message": f"API密钥申请成功，但保存到 .env 文件失败：{str(e)}。\n请手动设置环境变量 {API_KEY_ENV}。",
            "envFilePath": str(env_file)
        }

• Confidence: 91% confidence
• Finding: The error path instructs the user to manually set the API key environment variable, normalizing direct handling of a sensitive secret without guardrails. Combined with this file's unrelated credential/billing logic, this increases the likelihood of insecure secret distribution, shell-history leakage, or accidental disclosure during troubleshooting.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 93% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any newer major or minor release. This can introduce unreviewed breaking changes or vulnerable/transitively risky versions into the skill at install time, reducing build reproducibility and making supply-chain risk harder to control.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 87% confidence
• Finding: The explicit use of require_auth=False disables an important security control for credential issuance. This is dangerous because it lowers the barrier for unauthorized users or automated abuse to obtain service access, especially when embedded in a skill whose published purpose gives no indication that credential provisioning should occur at all.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 87% confidence
• Finding: The explicit use of require_auth=False disables an important security control for credential issuance. This is dangerous because it lowers the barrier for unauthorized users or automated abuse to obtain service access, especially when embedded in a skill whose published purpose gives no indication that credential provisioning should occur at all.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:61