LinkedIn 学校详情查询，从 LinkedIn数据获取含名称、类型、地理位置与社媒链接的详细学校信息。帮助招聘人员、研究人员与分析师核验教育机构、研究学术关系网、丰富机构数据——适合学历核验、院校研究与学术关系网分析。

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:04 AM UTC
• Version: 1.0.5

Overview

The skill mostly supports a paid LinkedIn school lookup, but it also includes credential creation, plaintext key storage, billing-order helpers, error reporting, and automatic version-check persistence that deserve review before installation.

Install only if you are comfortable with this skill managing a UPKUAJING API key, storing it in ~/.upkuajing/.env, contacting the provider for lookups and version checks, and helping create recharge/payment orders. Confirm paid queries separately, avoid sending sensitive payloads in error reports, and protect or replace the plaintext .env storage if this runs on a shared machine.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior includes reading environment variables, accessing and writing to ~/.upkuajing/.env, and making network requests. This under-declaration can mislead users and orchestrators about the skill's real capabilities, reducing informed consent and making credential or billing-related side effects harder to audit.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description says it retrieves LinkedIn personal school details, but the document also instructs the agent to create API keys, write secrets to local files, query account and pricing information, create recharge orders, and report errors to a third party. This behavior expansion is dangerous because it mixes data retrieval with credential management, billing, and outbound reporting, increasing the chance of unauthorized side effects and user deception.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file metadata and docstring describe account authentication, key issuance, recharge, and pricing functions for a third-party platform rather than LinkedIn school-detail retrieval. This capability mismatch is dangerous because users or orchestrators may invoke the skill expecting read-only profile enrichment, while it actually enables credential provisioning and billing-related operations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The executable logic performs remote account actions including API key creation, account info retrieval, recharge order creation, and pricing queries, which materially exceed the declared purpose of fetching LinkedIn education details. In agent ecosystems, such hidden side-effecting behavior increases the risk of unauthorized account changes, surprise charges, and trust-boundary violations.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Creating a recharge order has no direct functional necessity for a skill presented as academic/background information lookup. This expands the attack surface to financial operations and could be abused to trigger payment flows or socially engineer users into approving charges under a misleading skill label.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The ability to request and persist a platform API key is disproportionate to a skill advertised as a profile-information lookup utility. Credential lifecycle operations inside a data-enrichment skill create unnecessary access expansion and may leave long-lived secrets on disk without the user understanding that account credentials are being provisioned.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module performs outbound network access and writes persistent local state that are unrelated to the skill’s stated purpose of retrieving LinkedIn school details. Even if intended for update checking, this adds hidden side effects, expands the attack surface, and can leak usage metadata or be abused if the configured API endpoint is untrusted or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code includes self-update/version telemetry behavior that is not necessary for the declared business function of the skill. Such functionality can be used to track installations or pave the way for remote influence over client behavior, especially when the server response is trusted as authoritative for upgrade decisions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs agents to send requestParams, responseData, and detailed error context to an external error-reporting endpoint, but it does not require explicit user notice, consent, or strict data minimization before transmission. In a skill that processes LinkedIn profile and education/background data, these fields can contain personal data and sensitive operational context, creating privacy and data-sharing risk if agents forward them automatically during failures.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code writes a newly issued API key directly to a local .env file without a confirmation prompt or an explicit warning before persistence. This is dangerous because it silently creates a durable secret on disk, which may be exposed through backups, weak file permissions, shared environments, or later accidental disclosure.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script forwards a caller-supplied context field to a remote error-reporting endpoint without any visible minimization, redaction, or consent controls in this file. In the context of a LinkedIn profile enrichment skill, error context may contain personal data, request metadata, or sensitive operational details, creating a risk of unintended data exfiltration to the platform when failures occur.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The version check sends the skill name to a remote API without any user-facing disclosure or consent. While the payload is small, it still reveals installed-skill metadata and timing of use, which can expose operational information when correlated server-side.

Credential Access

High

• Category: Privilege Escalation

Content

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

• Confidence: 97% confidence
• Finding: The skill instructs the agent to read a local secrets file and check for UPKUAJING_API_KEY, then potentially trigger workflows that handle credential material. Accessing ~/.upkuajing/.env exposes sensitive local secrets to a skill whose stated purpose is data lookup, and increases the risk of credential disclosure, misuse, or unintended propagation through logs and downstream actions.

Credential Access

High

• Category: Privilege Escalation

Content

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

• Confidence: 98% confidence
• Finding: The skill goes further by offering to申请 a new API key and automatically save it to ~/.upkuajing/.env. This creates credential material and writes it to persistent local storage from within a broadly described lookup skill, expanding the blast radius to credential creation, persistence, and possible future abuse if the host environment is shared or compromised.

Credential Access

High

• Category: Privilege Escalation

Content

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

• Confidence: 94% confidence
• Finding: This line begins the write of a freshly created API key into a local .env file, creating a durable plaintext credential store. Plaintext local secret persistence materially increases exposure risk if the workstation, repository, backup system, or surrounding tooling leaks environment files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.23.0

• Confidence: 96% confidence
• Finding: The dependency is specified with only a lower bound (`httpx>=0.23.0`), which allows installation of any newer release, including versions with breaking changes or newly introduced supply-chain risk. This weakens build reproducibility and can unexpectedly pull a vulnerable or incompatible version during deployment.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: The `require_auth=False` setting disables authentication checks for the key-creation request, which is an unsafe default in the context of a skill that is supposed to perform data lookup only. In combination with the skill/purpose mismatch, this makes hidden account bootstrap behavior more dangerous because a caller may trigger credential issuance without realizing it.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

• Confidence: 86% confidence
• Finding: The `require_auth=False` setting disables authentication checks for the key-creation request, which is an unsafe default in the context of a skill that is supposed to perform data lookup only. In combination with the skill/purpose mismatch, this makes hidden account bootstrap behavior more dangerous because a caller may trigger credential issuance without realizing it.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196