LinkedIn 学校详情查询，从 LinkedIn数据获取含名称、类型、地理位置与社媒链接的详细学校信息。帮助招聘人员、研究人员与分析师核验教育机构、研究学术关系网、丰富机构数据——适合学历核验、院校研究与学术关系网分析。

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 1.0.5

Overview

The skill mostly does the advertised school lookup, but it handles API credentials and local persistence in ways users should review before installing.

Install only if you are comfortable with this skill using the Upkuajing API, charging per call after confirmation, and storing an API key under `~/.upkuajing`. Do not print or paste the `.env` file into chats or logs, restrict the file permissions yourself, and review any error report contents before allowing upload.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Credential File Contents Are Instructed to Be Printed to the Terminal

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-44
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

bash

cat ~/.upkuajing/.env

text

UPKUAJING_API_KEY=your_api_key_here

Technical Analysis

The instructions recommend printing the complete contents of the credential file to standard output. Although accessing the API key is necessary for authenticated API requests, displaying the entire file is not required for the declared school-detail lookup functionality.

Terminal output may be retained in agent transcripts, command logs, CI output, terminal scrollback, screenshots, or monitoring systems. The command also exposes every other value stored in the file, not only the required API key.

The implementation in scripts/common.py can load the key directly, so displaying it provides no functional security benefit.

Attack Path

1. A user or agent follows the documented credential-check procedure.
2. The complete ~/.upkuajing/.env file is printed to standard output.
3. The output is captured in an agent transcript, terminal log, CI log, or shared screen.
4. A party with access to that output obtains the API key or other secrets present in the file.
5. The exposed key is used to issue authenticated API requests, inspect account information, create recharge orders, or consume the associated account balance.

Impact Assessment

An attacker could act with the API privileges granted to the exposed key. The practical scope includes paid API consumption and access to account-related information exposed by the service. This does not provide operating-system privilege escalation, but it can compromise the associated Upkuajing API account and any additional secrets stored in the same file.

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to run cat ~/.upkuajing/.env.
• Check only whether the variable exists without revealing its value, for example by using the existing get_api_key() function or a command that emits only a present-or-missing status.
• Never ask users to paste API keys into conversational output.
• Recommend using the process environment or a dedicated secret manager where available.
• Warn users not to place unrelated credentials in the same file.
• Redact API keys from transcripts, diagnostics, and error messages.
• Rotate any key that has already appeared in terminal or agent logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth.py:62

Finding

API Key Is Persisted Without Explicitly Restrictive Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/auth.py, lines 62-74
Vulnerability Type: Insecure plaintext secret storage
Risk Level: Medium

python

try:
    UPKUAJING_DIR.mkdir(parents=True, exist_ok=True)
except OSError as e:
    return {
        "success": False,
        "message": f"API key creation succeeded, but directory creation failed: {str(e)}.",
        "envFilePath": str(env_file)
    }

try:
    with open(env_file, 'w', encoding='utf-8') as f:
        f.write(f"{API_KEY_ENV}={api_key}\n")

Technical Analysis

A newly issued API key is written in plaintext to ~/.upkuajing/.env, but the code does not set restrictive permissions on either the directory or the file. The resulting permissions depend on the process umask and any pre-existing filesystem object.

Under a common umask such as 022, a newly created regular file can be readable by other local users. If the file already exists with permissive permissions, opening it with w truncates it but does not correct its mode. The directory is likewise created without an explicit owner-only mode.

Persisting the key is related to the Skill's authentication workflow, but making it potentially accessible to unrelated local principals exceeds the minimum access required.

Attack Path

1. A user runs python scripts/auth.py --new_key.
2. The service returns a new API key.
3. The script creates or overwrites ~/.upkuajing/.env without explicitly setting an owner-only mode.
4. On a multi-user system with a permissive umask or pre-existing permissive file, another local account reads the file.
5. The attacker uses the recovered bearer token against https://openapi.upkuajing.com.

Exploitation requires local filesystem access through another account, a compromised process, or an environment that archives the home directory with overly broad access.

Impact Assessment

The exposed token grants the attacker's reques ...[truncated 302 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.upkuajing with mode 0700.
• Create the credential file atomically with mode 0600, using os.open with O_CREAT, O_WRONLY, and an explicit mode.
• Apply os.chmod(env_file, 0o600) after securely opening or replacing the file, including when it already exists.
• Refuse to write through symbolic links and verify that the target is an owner-controlled regular file.
• Use an atomic temporary file in the same directory followed by os.replace.
• Prefer an operating-system credential store or secret manager over a plaintext environment file.
• Avoid overwriting unrelated entries in an existing .env file.
• Document key rotation and revocation procedures.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Uses an Unbounded Version Range Without Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

text

httpx>=0.23.0

Technical Analysis

The dependency declaration accepts every future httpx release at or above version 0.23.0 and provides no package hash. Consequently, installations performed at different times may resolve to different code that was not covered by this audit.

No evidence indicates that the currently published httpx package is malicious. The finding concerns reproducibility and supply-chain exposure: a compromised upstream release, repository account, package index, or dependency resolution path could introduce changed code during installation.

Because httpx processes bearer-authenticated requests in this project, compromise of the resolved package would execute attacker-controlled Python with the privileges of the user running the Skill and could access API credentials in process memory.

Attack Path

1. A future allowed httpx release or its dependency chain is compromised, or dependency resolution is redirected to an untrusted package index.
2. A user follows the documented pip install -r requirements.txt procedure.
3. The resolver selects the compromised version because the requirement has no upper bound, exact pin, or hash.
4. Malicious installation or runtime code executes with the invoking user's privileges.
5. That code may read local files accessible to the user, capture the API bearer token, alter API traffic, or execute additional local actions.

This path is conditional on an upstream or package-distribution compromise; the audited files do not contain evidence of an active malicious dependency.

Impact Assessment

A successful dependency-chain compromise could execute code with the privileges of the user installing or running the Skill. That could expose the API key and other user-readable data or tamper with API ...[truncated 107 chars]

Remediation

View remediation

Remediation Suggestions

• Pin httpx and its transitive dependencies to reviewed versions through a lock file.
• Generate and enforce package hashes, such as with pip-compile --generate-hashes and pip install --require-hashes.
• Use only explicitly trusted package indexes and disable unexpected extra indexes.
• Review and update pinned versions on a controlled schedule after security testing.
• Run dependency vulnerability and license scanning in continuous integration.
• Install dependencies in an isolated virtual environment under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the associated implementation performs undeclared version checks, caching, or update-related network/file operations, that behavior exceeds the stated purpose and introduces hidden outbound requests and local state changes. Hidden maintenance traffic is less severe than credential handling, but it still reduces transparency and can create unnecessary data exposure paths in a sensitive agent runtime.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the associated implementation performs undeclared version checks, caching, or update-related network/file operations, that behavior exceeds the stated purpose and introduces hidden outbound requests and local state changes. Hidden maintenance traffic is less severe than credential handling, but it still reduces transparency and can create unnecessary data exposure paths in a sensitive agent runtime.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the associated implementation performs undeclared version checks, caching, or update-related network/file operations, that behavior exceeds the stated purpose and introduces hidden outbound requests and local state changes. Hidden maintenance traffic is less severe than credential handling, but it still reduces transparency and can create unnecessary data exposure paths in a sensitive agent runtime.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the associated implementation performs undeclared version checks, caching, or update-related network/file operations, that behavior exceeds the stated purpose and introduces hidden outbound requests and local state changes. Hidden maintenance traffic is less severe than credential handling, but it still reduces transparency and can create unnecessary data exposure paths in a sensitive agent runtime.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the associated implementation performs undeclared version checks, caching, or update-related network/file operations, that behavior exceeds the stated purpose and introduces hidden outbound requests and local state changes. Hidden maintenance traffic is less severe than credential handling, but it still reduces transparency and can create unnecessary data exposure paths in a sensitive agent runtime.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill explicitly instructs reading ~/.upkuajing/.env and even displaying it with cat, which risks exposing API credentials to the agent, logs, or user-visible output. In an agent environment, direct secret-file reads are particularly dangerous because they normalize credential access beyond the minimum needed to perform the task.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

API密钥与充值

使用此技能需要API密钥。API密钥保存在 ~/.upkuajing/.env 文件中：

bash

cat ~/.upkuajing/.env

文件内容示例：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This section directs the workflow to check for an API key in a local secret file and, if absent, potentially initiate automatic key creation and storage. Combining credential discovery with automated credential provisioning expands access beyond simple data retrieval and can lead to unauthorized account creation, unexpected secret persistence, or leakage through local files.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

### **未设置API密钥**
请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documented behavior includes writing newly obtained API keys into ~/.upkuajing/.env, which is persistent secret storage in the local filesystem. Persisting secrets from an agent-run skill increases the risk of later disclosure to other tools, logs, or users and exceeds the least-privilege expectations for a school-detail lookup skill.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

请先检查 `~/.upkuajing/.env` 文件是否有 UPKUAJING_API_KEY;
如果未设置 UPKUAJING_API_KEY API密钥，请提示并让用户选择：
1. 用户有，由用户提供(手动添加到 ~/.upkuajing/.env 文件)
2. 用户没有，你可使用接口进行申请（`auth.py --new_key`），申请到新密钥后，会自动保存到 ~/.upkuajing/.env
等待用户选择；

### **账户充值**

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file implements generic authentication, account management, key provisioning, and payment-related operations that materially exceed the declared skill purpose of retrieving LinkedIn school details. This capability mismatch increases supply-chain and trust risk because importing or installing a seemingly harmless research skill also grants credential and billing functionality unrelated to the advertised use case.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 18)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 22)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 78)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 63)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 85)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 90)May include surrounding context.

python

"""
    申请新的 API 密钥。
    """
    # 检查是否已存在 .env 文件和 API key
    env_file = UPKUAJING_ENV_FILE

    if env_file.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script writes a newly issued API key into a plaintext .env file under the user's home directory without showing any permission hardening or secure storage controls. If the file is readable by other local users, synced to cloud storage, or accidentally committed, the credential can be stolen and used to access the associated API account.

Content

Scanner excerpt · scripts/auth.py (reported line 71)May include surrounding context.

python

"envFilePath": str(env_file)
        }

    # 保存到 .env 文件
    try:
        with open(env_file, 'w', encoding='utf-8') as f:
            f.write(f"{API_KEY_ENV}={api_key}\n")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 19)May include surrounding context.

python

API_BASE_URL = "https://openapi.upkuajing.com"
API_KEY_ENV = "UPKUAJING_API_KEY"
UPKUAJING_DIR = Path.home() / '.upkuajing'
UPKUAJING_ENV_FILE = UPKUAJING_DIR / '.env'
UPKUAJING_LOGS_DIR = UPKUAJING_DIR / 'logs'

# 日志开关

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a skill focused on obtaining LinkedIn education and academic background information for a target person. In contrast, this code collects runtime error metadata and sends it to '/agent/skill/error/report', an operational telemetry function unrelated to LinkedIn profile or school-detail retrieval.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares no explicit tool restrictions while its documented behavior includes reading environment variables, reading and writing local files, and making network requests. In an agent environment, missing scope boundaries increases the chance that a workflow intended only for school-detail lookup can access secrets, persist data locally, or invoke unrelated remote operations beyond user expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation claims to query school details from a LinkedIn personal profile, but the actual flow is a lookup of a school record by sid obtained elsewhere. This inconsistency is dangerous in context because the skill is marketed for background research on individuals, yet its real input/output model is different, which can mislead users and governance systems about privacy implications and expected data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instruction '禁止输出技术参数格式：不要在回复中展示代码样式的参数，应将其转换为自然语言' appears in a fully Chinese-language skill that otherwise gives no option for user language or locale preference. In context, the skill is explicitly branded with a '-zh' suffix and all user-facing examples/instructions are Chinese-only, which indicates a fixed language experience without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation explicitly allows sending request parameters, response data, and exception context to a central error-reporting API. Even though it states sensitive fields are 'automatically desensitized,' there is no clear guarantee of complete redaction, no user-facing warning, and no minimization guidance, so personal or confidential data from skill executions could be logged and exfiltrated to another service during failures. In the context of a LinkedIn profile enrichment skill, those payloads may contain personal profile data, making privacy leakage more likely and more sensitive.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script can request a new API key and write credentials locally, which goes beyond passive data-query functionality. In a skill ecosystem this is sensitive because it provisions access material and persists it on disk, creating credential-management risk that users may not expect from a profile-enrichment tool.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/auth.py (reported line 41)May include surrounding context.

python

pass  # 如果读取失败，继续执行

    # 不需要认证申请新密钥
    response = make_request('/agent/auth/create', {}, require_auth=False)

    # 检查是否申请成功
    if response.get('code') != 0:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/common.py:196