ClawHub
Back to skill

Security audit

Pulls professional work-history records from LinkedIn datasets using a personnel-IDlookup. It extracts past employers, job titles together with employment start-and-enddates. Recruiters, hiring managers and sales teams validate career trajectories andevaluate professionals’ backgrounds to screen qualified applicants. This tool works wellfor candidate vetting, pre-employment background checks and overall talent acquisitionworkflows.

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its advertised paid LinkedIn work-history lookup, but it handles credentials, account/payment actions, and under-disclosed platform calls in ways users should review before installing.

Install only if you are comfortable sending LinkedIn employment-history queries and possible diagnostics to UpKuaJing, incurring API charges, and storing the API key locally. Do not let the agent print ~/.upkuajing/.env; use an environment variable or tightly permissioned secret file instead. For candidate screening, confirm you have authorization and minimize any error reports so they do not include personal data or raw responses.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:40
Finding

Credential File Contents Are Exposed Through Documented Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–42
Vulnerability Type: Unnecessary disclosure of plaintext credentials
Risk Level: Medium

Vulnerable Code

markdown
This skill requires an API key. The API key is stored in the `~/.upkuajing/.env` file:
```bash
cat ~/.upkuajing/.env

Technical Analysis

The Skill instructs the Agent to print the complete contents of the credential file. Reading the dedicated API key is necessary for authenticated requests, but displaying the entire file is not necessary to verify whether a key exists.

Executing this command places the plaintext API key—and potentially any other values stored in the same file—into terminal output. That output may subsequently appear in Agent context, execution logs, terminal recordings, debugging traces, or generated responses.

This exceeds the minimum privilege and disclosure required for the declared LinkedIn employment-history lookup functionality.

Attack Path

  1. The Agent follows the environment setup instructions.
  2. It executes cat ~/.upkuajing/.env.
  3. The plaintext API key is written to observable command output.
  4. The output is retained in Agent context, logs, recordings, or another monitoring system.
  5. A party with access to that output extracts the key.
  6. The exposed Bearer credential is reused to make authenticated and potentially chargeable API calls.

Impact Assessment

Successful exploitation exposes the UpKuaJing API key. An attacker possessing the key may be able to:

  • Make authenticated API requests under the victim's account.
  • Consume the victim's paid API balance.
  • Access account information exposed by the authenticated account endpoint.
  • Submit requests or reports attributable to the victim's credential.

This does not directly grant operating-system privileges, but it compromises the authority and paid resources associated with the API account.

Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to run cat ~/.upkuajing/.env.
  • Check only whether UPKUAJING_API_KEY is present and nonempty without displaying its value.
  • Prefer environment-based secret injection over reading a persistent plaintext file.
  • If diagnostic output is required, display only a non-sensitive status such as API key configured.
  • If key identification is necessary, show only a short masked fingerprint and never enough characters to reconstruct the credential.
  • Ensure Agent responses and logs never include the raw API key.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/auth.py:68
Finding

API Key File Is Created Without Explicit Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 68–81
Vulnerability Type: Insecure plaintext secret-file permissions
Risk Level: Medium

Vulnerable Code

python
# 确保 ~/.upkuajing 目录存在
try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API密钥申请成功，但创建目录失败：{str(e)}。\n请手动创建目录 {UPKUAJING_DIR} 并设置环境变量 {API_KEY_ENV}。",
        "envFilePath": str(env_file)
    }

# 保存到 .env 文件
try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

A newly issued API key is persisted in plaintext using ordinary directory creation and file opening. The implementation does not explicitly require owner-only permissions such as 0700 for the directory and 0600 for the credential file.

Consequently, the resulting access permissions depend on the process umask and any permissions already present on ~/.upkuajing. In an environment with a permissive umask or shared account configuration, another local user may be able to read the credential.

The implementation also does not validate that the destination is a regular file rather than a symbolic link before overwriting it. Under circumstances where another local principal can manipulate the destination directory, this could redirect the write to another user-accessible location or overwrite a file writable by the victim.

Attack Path

  1. The Skill runs auth.py --new_key and obtains a new API key.
  2. The process creates ~/.upkuajing and .env using permissions derived from the current umask.
  3. Under a permissive local configuration, the credential file is readable by another local user or service.
  4. Alternatively, if an attacker can manipulate the destination directory, the attacker prepares a symbolic link at the .env path before the write.
  5. The script writes the plaintex ...[truncated 747 chars]
Remediation
View remediation

Remediation Suggestions

  • Create ~/.upkuajing with owner-only mode 0700.
  • Create the credential file atomically with mode 0600, for example by using os.open with O_CREAT, O_EXCL, and an explicit mode.
  • Apply and verify restrictive permissions on existing directories and files before use.
  • Reject symbolic links and verify that the destination is a regular file owned by the current user.
  • Write to a securely created temporary file in the same directory and atomically replace the destination.
  • Prefer an operating-system credential store or externally injected environment variable instead of persistent plaintext storage.
  • Avoid including any portion of an existing key in normal output, even though the current implementation displays only a prefix.

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Dependency Uses an Unbounded Version Range Without Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Non-reproducible and insufficiently constrained dependency installation
Risk Level: Low

Vulnerable Code

text
httpx>=0.23.0

The documented installation command is:

bash
pip install -r requirements.txt

Technical Analysis

The dependency declaration specifies only a lower bound. It permits installation of any future httpx release and resolver-selected transitive dependencies. No lockfile, upper bound, exact version, or package hash is provided.

No evidence indicates that httpx itself is malicious, typosquatted, or fetched from an unauthorized package source. The risk arises because future or otherwise unreviewed dependency versions can be selected at installation time, making the installed code different from the code considered during this audit.

Dependencies and their installation machinery execute with the privileges of the user performing the installation. A compromised package release, compromised package index, or unsafe future dependency change could therefore affect the Skill environment.

Attack Path

  1. A user follows the documented dependency-installation instructions.
  2. The package resolver selects the newest compatible httpx release and its current transitive dependencies.
  3. One selected artifact is compromised, unexpectedly changed, or incompatible with the audited implementation.
  4. The package's installation or runtime code executes with the installing user's privileges.
  5. The affected code may access data and credentials available to the Skill process, including the UpKuaJing API key.

This is a supply-chain risk path rather than evidence of an existing malicious package in the project.

Impact Assessment

If a selected dependency were compromised, it could execute Python code with the privileges of the user running the Skill. Potential scope would include ...[truncated 484 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin httpx to a reviewed exact version.
  • Generate and commit a lockfile containing all transitive dependency versions.
  • Require cryptographic hashes for downloaded artifacts.
  • Periodically update pinned dependencies through a controlled review and testing process.
  • Install dependencies inside an isolated virtual environment with only the permissions required by the Skill.
  • Use a trusted package index and disable unexpected fallback indexes.
  • Add automated dependency-vulnerability and integrity scanning to the release process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (40)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Remote version checks, local cache creation, metadata parsing, and upgrade messaging are operational behaviors not disclosed by the skill's stated purpose. These add unexpected network and filesystem activity, which can leak usage metadata and complicate trust assumptions for a tool framed as a simple background-check query.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Remote version checks, local cache creation, metadata parsing, and upgrade messaging are operational behaviors not disclosed by the skill's stated purpose. These add unexpected network and filesystem activity, which can leak usage metadata and complicate trust assumptions for a tool framed as a simple background-check query.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Remote version checks, local cache creation, metadata parsing, and upgrade messaging are operational behaviors not disclosed by the skill's stated purpose. These add unexpected network and filesystem activity, which can leak usage metadata and complicate trust assumptions for a tool framed as a simple background-check query.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Remote version checks, local cache creation, metadata parsing, and upgrade messaging are operational behaviors not disclosed by the skill's stated purpose. These add unexpected network and filesystem activity, which can leak usage metadata and complicate trust assumptions for a tool framed as a simple background-check query.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill explicitly instructs reading the contents of ~/.upkuajing/.env using cat, which exposes the full credential file rather than only checking whether a needed variable exists. In an agent setting, this is a direct credential-access pattern that can disclose secrets unnecessarily and normalize broad secret-file reads.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

This skill requires an API key. The API key is stored in the ~/.upkuajing/.env file:

bash
cat ~/.upkuajing/.env

Example file content:

text

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The workflow directs the agent to check a local secret file and then potentially obtain and automatically save a new API key into ~/.upkuajing/.env. Combining credential discovery, creation, and persistent storage inside a screening skill broadens secret-handling exposure and creates opportunities for accidental leakage, overwrite, or unauthorized account linkage.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
### **API Key Not Set**
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The instructions again direct inspection of ~/.upkuajing/.env and automatic persistence of a newly created key, reinforcing a pattern of direct local secret-file access in a skill whose primary purpose is data lookup. In context, this is especially risky because the same skill also performs network and billing-related operations, so compromise or misuse could expose both credentials and account state.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
First check if the `~/.upkuajing/.env` file has UPKUAJING_API_KEY;
If UPKUAJING_API_KEY is not set, prompt the user to choose:
1. User has one: User provides it (manually add to ~/.upkuajing/.env file)
2. User doesn't have one: You can apply using the interface (`auth.py --new_key`), the new key will be automatically saved to ~/.upkuajing/.env
Wait for user selection;

### **Account Top-up**

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements API key issuance, billing, recharge, and pricing functions for a cross-border platform, which is materially unrelated to the declared LinkedIn experience lookup skill. This kind of capability mismatch is dangerous because it can mislead users into granting trust to a skill that performs undisclosed account-management actions and external service interaction outside its stated purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring describes cross-border platform authentication management, directly contradicting the advertised LinkedIn personnel-history function. This discrepancy is a strong indicator of repurposed or mislabeled code, which is dangerous because it obscures the real behavior and undermines informed consent and security review.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python
"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High
Category
Privilege Escalation
Confidence
79% confidence
Finding

The code writes a newly issued API key into a plaintext .env file, which can expose credentials to other local users, backups, logs, or accidental inclusion in repositories. In the context of a mislabeled skill with unrelated billing/auth functions, plaintext secret storage is more concerning because it facilitates unauthorized use of external accounts and services if the host is shared or compromised.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python
"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python
API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements outbound error reporting to a platform endpoint, which is unrelated to the stated purpose of a LinkedIn work-history verification skill. In a personnel-screening context, the transmitted request metadata and free-form context field could contain candidate or operator-sensitive information, creating an unjustified data exfiltration path and a strong supply-chain mismatch indicator.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This module performs outbound network calls to a remote version API and writes persistent state to disk, behavior that is unrelated to the skill’s stated purpose of LinkedIn work-history verification. Even if framed as maintenance logic, hidden auxiliary behavior expands the trust boundary, creates unnecessary data-flow and persistence, and can enable covert telemetry or unexpected external dependencies in a sensitive candidate-screening context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The self-update/version-audit capability is not justified by the business function of verifying employment history, so it constitutes unnecessary privileged behavior. In a background-screening skill, unrelated remote calls are more concerning because operators may assume the skill only processes candidate lookup data, while it also contacts external infrastructure during execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares capabilities that imply environment access, filesystem reads/writes, and network use, but it does not expose any explicit tool scope or permission boundary. That makes it harder for reviewers and runtime policy to constrain what the skill may access, increasing the chance of over-privileged execution and misuse of local credentials or files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad enough to match common background-check, verification, and research requests without strong boundaries or prerequisite checks. In this context, that increases the likelihood of accidental invocation for sensitive people-search and screening tasks, potentially causing external disclosure of personal data or paid API use without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This skill is designed for candidate screening and employment-history lookup through an external platform, but the introductory description does not provide an upfront privacy warning or data-processing notice. Because the workflow concerns personal employment history, omission of early disclosure increases the risk of non-transparent handling of personal data and misuse in sensitive screening contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document instructs agents to send raw request parameters, response payloads, and exception context to an external error-reporting API, which can include highly sensitive personal or employment-screening data. Although it claims sensitive fields are 'automatically desensitized,' it does not define guarantees, scope, or user-consent requirements, creating a real risk of privacy leakage and overcollection during background-verification workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all user-facing help/messages are written only in Chinese, and there is no indication that users may choose another language or that the skill is restricted to a Chinese-only context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/common.py:196

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:61